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Preface 


The South African health care sector is antagonised by a multitude of 
challenges, notably fragmentation and lack of coordination among health 
care information systems, the preponderance of manual systems, the 
absence of automation and the lack of interoperability across various 
health care information systems where automation exists. Additionally, 
significant capital was spent on health information systems that ultimately 
failed to yield the anticipated business benefits. As the prosperity of every 
economy depends on the health of its workforce, the main objective is to 
deploy information systems that add value to the delivery of health care 
services. 


This multidisciplinary study explores and focuses on information 
technology (IT) governance implementation drivers, implementation 
strategies, implementation challenges and IT governance performance. An 
interpretive exploratory sequential mixed-methods approach was adopted, 
characterised by mixing qualitative and quantitative techniques, methods 
and approaches. Research instruments included semi-structured interview 
guide and a closed-ended survey questionnaire. Data were collected from 
business and IT decision-makers within private and public health care, 
including chief information officers (CEOs); IT governance officers; IT 
decision-makers; business decision-makers; board members; IT and IT 
governance committee members; governance, risk and compliance 
committee members; hospital CEOs; finance managers; human resources 
managers; nursing managers; and medical managers. Semi-structured 
interviews and the closed-ended questionnaire probed for participants’ 
experiences of IT governance implementation in health care in South Africa. 
Qualitative and quantitative data were separately analysed using the 
ATLAS.ti (version 8) and Statistical Software Package for the Social 
Sciences (SPSS; version 25), respectively. Results from the qualitative 
phase enabled the refinement of the survey questionnaire. In addition, 
results from each strand were combined at the data collection and at the 
data analysis and interpretation points. Conclusions and recommendations 
were made for respective stakeholders in line with the study findings. 


The exclusive addition to the body of knowledge was the uncovering of 
hidden sentiments of health care business and IT decision-makers on IT 
governance practices in private and public health care in South Africa. The 
study findings are expressed as an integrated final refined theoretical 
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Preface 


framework comprised of key constructs and their correlations. Participants 
emphasised that, certainly, internal organisational imperatives and pressure 
points drove IT governance implementation. They explained that the 
external environment had little or nothing to do with enforcing IT 
governance implementation in health care. Quantitative results reveal that 
despite the qualitative findings demonstrating that IT governance is 
implemented through structures, processes and relational mechanisms 
(Mangundu 2017), studied organisations are currently implementing IT 
governance through structures and processes only. Relational mechanisms 
are not part of IT governance initiatives in the organisations studied. 
Participants alluded to the fact that relational mechanisms are not of a 
higher order in IT governance initiatives and are given attention after 
structures and processes have been fulfilled. A composite category was 
supported that the inhibitors are purely organisational context factors. 
Results further proved that there is no correlation between external 
inhibitors and organisational inhibitors, proving the fact that organisations 
independently hold strong forces against IT governance implementation, 
that is, independently from the business environment in which they operate. 
Despite IT governance performance being measured in private health care, 
public health care does not measure IT governance, and clearly, IT is far 
from meeting intended business objectives in public health care. In addition, 
private health care showed a strong appreciation of their intended IT 
governance outcomes, together with the influence that IT governance has 
had on the outcomes. However, results reveal that IT governance is far from 
reaching intended performance. 


It is therefore crucial that IT decision-makers and IT governance 
practitioners understand the problem contexts before they embark on IT 
governance initiatives. Knowledge of the organisation’s position and needs 
reduces the complexity of the implementation of IT governance in that 
they would focus on the most important implementations in line with their 
organisations. In addition, IT governance as an innovation does not bring 
with it inhibiting factors. A pragmatic, realistic approach to IT governance 
is needed for successful implementation. In addition, there is no ‘one size 
fits all’ when it comes to IT governance, as the contexts are different. Thus, 
organisations should analyse and select the best controls for the 
organisation and not mainly target the highest IT governance maturity. 
Pragmatism reduces the complexity and the associated costs, enabling 
organisations to smoothly promote IT governance. 
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Chapter 1 


Overview and background of 
the study 


E introduction 


This study is multidisciplinary as it cuts across the fields of information 
technology (IT), governance and health care. The book aims to explore IT 
governance practices and associated implementation inhibitors in private 
and public health care. The scholarly contribution from this inquiry affords 
new insights for advancing IT governance implementation and associated 
maturity in South Africa, especially in the private and public health care 
sectors. This chapter begins with an overview and the background that 
informs the study, the problem statement, the research questions and 
objectives. In addition, it includes the study’s aims, the study’s justification 
and the study’s relevance. 


E Background and context 


The delivery of health care services to individuals and the creation of jobs 
are important functions of health care organisations in any economy. Well 
(2007, p. 2) contends that excellent health care plays a crucial role in 
promoting economic growth, wealth and advancement. These research 
findings support investing in a nation’s health care industry. Adopting 
information and communication technologies (ICTs) is the main tactic 
used by businesses in South Africa to promote growth and accelerate 
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economic development, regardless of their economic category. 
Information technology is seen as a significant 21st-century economic 
development accelerator, according to the Information Technology 
Governance Institute (ITGI 2001, p. 1). The development of a nation’s 
productive capacity across all economic sectors depends on ICT, which 
also links a nation to the global economy and promotes competitiveness. 
Scholars have linked economic performance to foreign direct investment 
(FDI), the level of IT investments and various other factors, and they have 
particularly documented them to have a direct impact on economic 
growth in developing economies such as South Africa (Dunne & 
Masiyandima 2017, p. 403; Hassan 2005, p. 1). Information and 
communication technology is fundamental to creativity, wealth 
development and invention (Hassan 2005, p. 1). Furthermore, ICT offers 
opportunities for global integration while maintaining the identity of 
traditional societies, and it improves the effectiveness, efficiency and 
transparency of the private and the public sectors, all of which help to 
reduce poverty, increase productivity and provide new economic 
opportunities. 


To gain or maintain a competitive edge, organisations, regardless of the 
economic sector they fall into, are investing a significant amount of money 
in ICT. According to Gartner (2022, p.1), soending on corporate IT worldwide 
was expected to exceed US$4.8 trillion in 2023. In 2022, the total IT 
spending in South Africa was recorded at US$14.59 billion, an increase of 
6.3% from the previous year (2021). As ICT is seen as a crucial component 
in advancing corporate strategy and achieving organisational goals, 
substantial funding has been directed towards IT investments and is 
estimated to reach US$3.2tn by 2025 (UN 2021, p. 4). Information 
technology evolved from merely serving as a support role to serving as a 
strategic tool for enhancing business competitiveness (Lee & Setiawan 
2013, p. 118). The increase in IT investment demonstrates how seriously 
businesses are investing in ICT. 


In view of the above, health care organisations, like other modern 
organisations, are progressively utilising IT and have grown to rely entirely 
on it for success. They also recognise that IT has evolved into a crucial 
strategic instrument (Lazic, Heinzl & Neff 2011, p. 1; Lee & Setiawan 2013, 
p. 1). Health care organisations are being forced to establish strategic 
information systems in their drive to deliver better and more efficient 
health care services because IT has shown to be a crucial benefit and tool 
in implementing business strategies (Jiandong & Hongjun 2010, p. 48). 
Health care information systems have measurable financial returns and 
advantages (AbuKhousa & Al-Qirim 2012, p. 1) which lead to improved 
service quality and cost reductions (Tsiknakis & Kouroubali 2009, p. 40). 
PricewaterhouseCoopers (2012, p. 8) confirmed earlier proponents by 
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highlighting how increased IT spending has led to more functional and 
enhanced health care services through artificial intelligence and virtual 
health care systems. 


For the delivery of health care services, both public and private sector 
health care organisations are becoming more reliant on IT (Van Grembergen 
& De Haes 2018, p. 4877; UN 2021, p. 4). Resultantly, the health care sector 
is one of the top industries for IT capital soending because of the continued 
investment in IT (AbuKhousa & Al-Qirim 2012, p. 1). The use of IT, however, 
has also exposed health care organisations to new risks in addition to the 
financial advantages it has provided. The postulation that IT benefits are 
incontrovertible post-adoption of a certain innovation is the litmus test for 
the concerned organisations (Baker 2012, p. 3; Jokonya 2014, p. 2). Kurkinen 
(2013, p. 468) maintains that it is still difficult for many organisations to get 
the desired benefits from IT, which is characterised by complicated 
decision-making pertaining to the procurement and use of such IT systems. 
After making significant financial commitments, many IT efforts have 
reportedly failed. The public and the private sectors continue to invest in IT 
despite the high rate of IT projects and investment failures (McManus & 
Wood-Harper 2007, p. 1). As a result, numerous IT governance frameworks, 
standards and solutions have been developed. Recently, IT governance 
practices have been cited as the remedies to IT initiative failures. Although 
these frameworks are available, low IT governance implementation rates 
are still acknowledged, which prevents many organisations from realising 
the benefits that they could. 


Although organisations spend a significant portion of their capital 
budgets on IT (Bloem, Van Doorn & Mittal 2005, p. 16; Maizlish & Handler 
2005, p. 6), achieving value and improving business performance have 
been highly challenging. McAfee (2004, p. 18) reported that IT adoption, 
implementation and management decisions are still difficult and 
complicated, which leads to the waste of enormous amounts of money 
on poor IT investments. The health care industry is frequently accused 
of having difficulty making IT decisions, which leads to impulsive and 
careless technology purchases. (Rothenberg & Korn 2005, p. 1). For the 
bulk of health care organisations, achieving actual benefits, value and 
returns that justify IT capital commitments remains a pipe dream 
(AbukKhousa & Al-Qirim 2012, p. 1). Few health care organisations are 
reported to be aware of how dependent their operations are on IT 
resources or how much IT influences the creation and accomplishment 
of organisational goals and objectives. For example, Maizlish and Handler 
(2005, p. 41) empirically argued that of the 28% of IT projects that were 
successful, more than 45% were over budget and 68% were completed 
in overtime. More than 70% of these initiatives failed to work as intended, 
ran over budget or failed to meet deadlines. The Standish Group’s (2004, 
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p. 2) report echoed the same sentiments as Maizlish and Handler (2005, 
p. 41) and reported that all IT initiatives that had a success rate of 29% 
lend credence to this. 


In line with the aforementioned problems, Trudel, Paré and Laflamme 
(2012, p. 2) attributed IT project failures to ill-informed IT acquisition 
decisions and the rising complexity of IT systems. Haux (2006, p. 268) 
confirmed that in the health care industry, issues such as a lack of 
experienced workers, poor project management techniques, uneven IT 
budget distribution, shaky IT operational management, a lack of data 
protection and security management, and a lack of IT strategy and 
leadership were frequently noted. As a result, most IT initiatives in this 
industry were reported as either struggling or being completely unable to 
deliver expected business value (Larsen 2008, p. 9). Heeks (2006, p. 127) 
further estimated that 33% to 66% of IT initiatives in health care were 
relatively producing the desired results and that 20% to 25% of IT initiatives 
were completely failing. Attending to the real root cause, besides the 
characteristics of these shortcomings, one may note that the main stumbling 
blocks to successful health care information systems development and 
implementation are closely linked and attributed to complications of IT 
decision-making, uninformed IT decision-making and weak IT governance 
practices (Van Grembergen & De Haes 2009, p. 123). 


Effective IT governance is essential to ensure that IT investments lead 
to the fulfilment of organisational objectives and the delivery of the 
anticipated value because of the complexity in making IT decisions and 
the significant portion of capital investment consumed by IT efforts 
(McKay, Marshall & Smith 2003, p. 956). According to Jacobson 
(2009, p. 1), businesses with mature, efficient IT governance enjoy greater 
economic value and benefits from their IT investments than their 
competitors. Even when they employed the same business strategy, 
organisations employing effective IT governance witnessed returns on 
their investments that were 20% greater than those with poor IT 
governance (Weill & Ross 2004a, p. 14). Lingyu et al. (2010, p. 431) further 
assert that businesses with average IT governance performance may 
witness a 20% increase in returns on their IT investments. Superior IT 
governance procedures lead to improved IT outcomes, according to Wu, 
Straub and Liang (2015, p. 498). In another study, Simonsson (2008, p. 11) 
emphasised that credible IT governance supports making sure IT improves 
business strategy and goals, maximises business investments in IT and 
makes sure IT risks and opportunities are managed effectively. Resultantly, 
greater IT performance contributes to improved organisational 
performance (Tonelli et al. 2017, p. 1; Zhang, Zhao & Kumar 2016, p. 357). 
The aforementioned scholarly arguments scientifically show the crucial 
function that IT governance has in contemporary organisations. 
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High IT investment costs, high IT initiative failure rates, especially in the 
health care industry, and the significant impact that IT investments and 
decision-making activities have on organisational prosperity (Devaraj & 
Kohli 2003, p. 274) - in addition to increased external pressure from 
stakeholders to manage and keep track of costs - make it clear why 
effective IT governance is proposed as a key course of action to ensure 
that IT investments provide expected returns (Jacobson 2009, p. 2). As a 
result of the need to govern IT investments, significant effort has gone into 
designing and formalising of different IT governance standards, frameworks, 
and solutions. Globally, various frameworks have been proposed, including 
Control Objectives for Information and Related Technologies (COBIT), 
Information Technology Infrastructure Library (ITIL), ISO/IEC 20000, and 
ISO/IEC 27001. In South Africa, the King III Report addressed the topic of 
IT governance for the first time in 2009, and it is advised that most South 
African organisations follow the report’s recommendations. Nevertheless, 
studies demonstrate that only a relatively small number of organisations 
have embraced such well-designed IT governance principles, frameworks 
and solutions (ITGI 2011, p. 3). There have also been reports of low IT 
governance implementation across the globe and difficulties with the 
effective application of IT governance have also been found in developed 
nations (Fairchild 2004, p. 1; Fox, Ward & O’Rourke 2006, p. 316; Weill & 
Woodham 2002, p. 2). Observations have been made and reported that 
effective IT governance frameworks and solutions are being adopted at 
even lower rates in developing economies (ITGI 2008a, p. 5). 


E Research problem 


Concerns regarding IT governance issues have been raised during 
telephonic conversations with some IT decision-makers and leaders in 
South African private and public health care sectors. Problems of high IT 
project failure rates, high IT investment costs and IT investments that either 
partially or completely achieve desired business objectives are only a few 
of the concerns identified. Some IT decision-makers claimed that the 
complexity of IT decision-making procedures was the root cause of these 
issues (IT governance). For example, the then-Minister of Health, Dr Aaron 
Motsoaledi, stated in a speech in 2012 that (National eHealth Strategy 
South Africa 2012): 


[T]he health information systems in South Africa have been characterised by 
fragmentation and lack of coordination, prevalence of manual systems and lack 
of automation, and where automation existed, there was a lack of interoperability 
between different systems. (p. 9) 


Furthermore, the minister alluded that ‘Significant financially backed 
resources were also invested in these systems, which ultimately did not 
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yield the anticipated returns on investment’ (National eHealth Strategy 
South Africa 2012, p. 9). The problems of interoperability of the eHealth 
care systems are further highlighted in the National Digital Health Strategy 
for South Africa (Department of Health 2019-2024, p. 14). 


Despite significant investments over the years in the purchase of health 
information systems (HIS) in South Africa, according to the Negotiated 
Service Delivery Agreement (NSDA) (2010-2014), ICTs and the HIS within 
the health care system were not living up to expectations of improving 
business processes within the health care sector. The health care system 
was unable to produce sufficient data and information to management for 
performance monitoring for the evaluation of the national health care 
system, according to the NSDA’s study (National eHealth Strategy South 
Africa 2012). The absence of technological rules and regulatory frameworks 
in the implementation of ICT infrastructure (IT governance) has been 
blamed for these issues. 


Regardless of a multitude of such IT governance problems, there is a 
dearth of studies that investigate and provide reports on IT governance 
in the health care industry (AbuKhousa & Al-Qirim 2012, p. 2). This 
circumstance necessitates research on the issues inhibiting the adoption 
of IT governance frameworks and standards. Given the aforementioned IT 
and IT governance problems, it became essential to undertake a study to 
ascertain the existing state of IT governance implementations in South 
African private and public health care sectors, as well as the challenges 
they are facing and how effective IT governance may be promoted in 
South Africa. Scholarly enquiry and comprehension of the implementation 
challenges that the health care industry is facing become essential to 
recommend strategies for improved IT governance. The goal of this study 
is to determine the drivers for IT governance in the South African health 
care industry and implementation strategies, with special attention to the 
implementation inhibitors. 


E Aims and objectives of the book 


The aim of the book is to determine IT governance practices and inhibitors 
to their implementation in private and public health care in South Africa. 


The objectives of the book are: 


e To determine the drivers of IT governance in South African private and 
public health care sectors. 

e To determine IT governance practices being implemented by South 
African private and public health care sectors. 

e To establish the inhibiting factors to the successful implementation of IT 
governance in private and public health care sectors in South Africa. 
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e To determine IT governance performance in South African private and 
public health care sectors. 


E Research questions 
The research questions are: 


e What are the drivers for IT governance implementation in South African 
private and public health care sectors? 

e How is IT governance being implemented in South African private and 
public health care sectors? 

e What are the inhibiting factors to the successful implementation of IT 
governance in the private and public health care sectors in South Africa? 

e How is IT governance performing in South African private and public 
health care sectors? 


E Study justification 


The study assists South African health care sectors in implementing IT 
governance more effectively, allowing them to get more value out of their IT 
projects and investments. The study of inhibitors is essential because, once 
they are recognised, their effects can be understood and remedied. The South 
African Department of Health will have the ability to create new regulations 
or change existing ones to support improved IT value delivery and reduce IT 
risks. Without conducting the analysis, organisations might keep making poor 
IT investment decisions that can result in governance scandals, adversely 
affect health care service delivery and hamper economic growth. 


E The importance of the study 


In many organisations, achieving sustainable IT benefits is still a difficult task, 
and there are not many in-depth studies on IT governance (Jokonya 2014, 
p. 6). The body of literature reveals some knowledge gaps and inequities in 
relation to the organisational barriers to IT governance. Therefore, it is crucial 
to comprehend the barriers to enhance intervention strategies in the field of 
IT governance. To the best of the researcher’s knowledge, this book will be 
the first to identify obstacles to IT governance implementation as well as to 
suggest and advocate solutions to these inhibitors in the South African 
health care industry. Given that IT governance is still a relatively new concept 
in the health care industry, it is to be expected that health care organisations 
have little expertise on this phenomenon. This book aims to add to the 
limited knowledge among academics and practitioners by extending this 
knowledge by supplying insights into drivers of IT governance and its 
implementation barriers using the technology-organisation-environment 
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(TOE) framework. Additionally, academics and researchers will have access 
to literature for future studies in the field of IT governance, particularly in the 
health care industry of a developing nation. 


E Study limitations 


The study’s principal limitations related to the study’s participants, who 
were decision-makers in business and IT who held strategic positions. 
These participants struggled to be available for participation because they 
were under pressure from their organisational businesses. Even if their 
opinions might not accurately represent those of the initially targeted 
respondents, the solution was to identify and solicit input from those 
second in line of power. The fact that only two of the nine South African 
provinces were used to choose the study organisations and their associated 
hospitals meant that they could not be taken to represent South Africa as 
a whole. However, study findings are applicable to comparable settings 
within southern Africa and beyond. 


E Ethics-related matters 


A two-step ethical approval process was followed before and during the 
data collection phase of the study to ensure informed consent, confidentiality, 
and anonymity were upheld. The University of KwaZulu-Natal approved the 
study, which required and received ethical approval and was permitted by a 
clearance certificate (HSS/0102/015D). The researcher then applied to the 
Department of Health and the private health care organisation research 
committees for ethical clearance letters, which were successfully obtained. 
The submission of the research proposal, university ethical approval and 
letters from the research leaders all helped to speed up the procedure. The 
researcher then went on to ask gatekeepers for permission to collect data 
after getting the organisations’ ethical clearance letters. As a result, consent 
letters were signed to demonstrate informed consent for the study. The 
researcher had to get permission from the interviewees in order to record 
the interviews. The data were exclusively utilised for research purposes, and 
all essential security precautions were taken to keep it safe and prevent it 
from falling into the wrong hands. The organisations are identified by 
pseudonyms in accordance with the request for anonymity made by the 
participating organisations. 


E The structure of the book 


The book is divided into logically interconnected chapters to strategically 
address the research issues and realise the targeted study objectives. As 
such, the book is organised into eight chapters as follows: 
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Chapter 1: Problem formulation and research plan 


The book’s introduction is discussed in Chapter 1, along with the research 
problem that gave rise to the need for the scholarly work. In addition, the 
research objectives, research questions, the research topic and its 
subproblems are discussed. 


Chapter 2: Literature review 


The literature discussion provides an evaluation of prior scholarly work in 
the field of IT governance as well as relevant prior research on the various 
IT governance topics under discussion. The literature review begins with a 
broad overview before focusing more closely on the fundamental issues 
raised by the most recent research. The first section examines enterprise 
governance before funnelling down to its branch of corporate governance 
and finally to IT governance. The second section reviews the drivers that 
influence IT governance, IT governance implementation, the implementation 
inhibitors and IT governance performance, through scanning and discussion 
of related prior studies. The chapter also provides a detailed explanation of 
the book’s theoretical underpinnings. Accordingly, different theories are 
unpacked, and the pertinent theories deemed most suitable to guide the 
scholarly discussion of the phenomenon in the book are provided together 
with their reasoning. The pertinent theories are applied to construct an 
initial conceptual framework that directs this scholarly inquiry while 
providing alignment of the steps in this scientific enquiry. 


Chapter 3: Philosophical grounding and 
philosophical assumptions 


The theoretical grounding chapter discusses the fundamental moulds that 
give rise to a valid research and suitable research methods. 


Chapter 4: Research methodology 


The scientific study design and methodology used to answer the research 
questions are discussed in the research methodology, along with the 
justification of the methodology used. The steps for data-gathering and 
analysis are also specified and discussed. 


Chapter 5: Coding qualitative data and 
qualitative findings 
Data have little to no value if they are not meaningfully extracted, 


necessitating the use of scientific methodologies to address the study 
questions. Primary codes from the problem statement and the research 
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questions were used to code the data. Ideas and themes derived from the 
data were coded using inductive and deductive methods, and other 
findings from the literature review supported those findings. This chapter 
presents qualitative findings. 


Chapter 6: Analysis of quantitative data and 
quantitative findings 


Phase 2 of the research’s data collection involved an online survey. To 
derive significance from the responses, statistical inferences were made 
on the data. This chapter discusses the quantitative data analysis and 
quantitative findings. 


Chapter 7: Integrated results 


To derive meanings and scholarship from the research, both qualitative and 
quantitative findings are examined in this chapter. Discussions are held and 
useful ideas are found that can enlighten organisations about the IT 
governance phenomenon and make contributions to the field. Based on 
the empirical data gathered and analysed, the research framework is 
refined. 


Chapter 8: Conclusions and recommendations 


The chapter presents the researcher’s findings, which were derived from 
those found in Chapters 5, 6 and 7. The results’ ramifications for the 
Department of Health and the private health care industry are outlined to 
helo them promote IT governance and derive maximum benefits from 
their IT investments. In addition, limitations on the current research, 
recommendations and prospects for future research are discussed. 


Book input 


The book’s main contribution is to examine implementation inhibitors to IT 
governance to create and validate recommendations to overcome the 
associated barriers and promote improved IT governance in private and 
public health care sectors. 


E Conclusion 


This chapter emphasises the value of IT to organisations. The chapter goes 
on to discuss the difficulties that come with IT projects in health care and 
the need for IT governance to get the most out of such IT investments. 
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Regardless of the availability of frameworks, standards and solutions for IT 
governance implementation, the chapter observes that its uptake is still 
limited. The low implementation status of IT governance made it imperative 
to investigate the causes of this to make suggestions for change, which is 
the aim of this book. The chapter also supports the approach for validating 
the inhibitors to assist organisations in solving them and enhancing IT 
governance. A survey of the literature on IT governance implementation is 
presented in the following chapter. 


Theoretical Perspectives 


E introduction 


The research problem, research questions and study strategy were 
discussed in the previous chapter. As a starting point, this chapter offers 
a thorough and insightful survey and discussion of IT governance and 
related literature. Through investigation of the implementation of 
IT governance domain, the procedure makes it easier to refine the 
research questions. The literature review gives the researcher the 
opportunity to study and identify problems and the research gap in the 
domain of IT governance implementation. By using WORDLE to extract 
essential ideas from the problem statement, the literature review is 
facilitated. 


The literature discussion is crucial for comprehending the IT governance 
issue from a wider perspective, including various countries, economic 
sectors and business environments. A wider perspective is essential to fully 
comprehend the drivers for IT governance, implementation strategies, 
inhibitors and performance. The literature review is organised thematically, 
with each theme within the subject matter being methodically examined 
separately before being addressed together. Firstly, by examining the 
conceptual ideas relevant to corporate governance and enterprise 
governance, an assessment of the major challenges surrounding the 
governance phenomenon under research is conducted. Secondly, the 
research questions are used to direct a focus-limiting process to address 
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studies that relate to this study, with an emphasis on IT governance, IT 
governance drivers, IT governance implementation strategies, IT governance 
inhibitors and IT governance performance. 


The literature review serves several purposes. Firstly, readers are 
informed of the findings of earlier investigations that are relevant. 
Secondly, the literature review process links the present research to an 
ongoing discussion around the phenomenon and identifies and 
contributes to the gap by building upon and expanding earlier findings 
(Marshall & Rossman 2014, p. 86). The study’s relevance is established, 
and a standard for findings’ discussion in relation to relevant earlier 
findings is made possible. The literature review achieves several goals, 
including incorporating what other scholars have said and done, 
criticising prior work, building connections between related topics 
and identifying key challenges in the study field (Okoli & Schabram 
2010, p. 1). 


The organisation of this chapter is as follows: The method of a literature 
review is covered in the first section. The sections that follow examine 
additional topics connected to IT governance, such as enterprise 
governance, business governance, corporate governance, the connection 
between corporate governance and IT governance, and finally, a discussion 
of previous scholarly work related to this study. 


E Process of a literature review 


Utilising ATLAS.ti, a computer-aided qualitative data analysis system 
(CAQDAS), the researcher carried out the literature review. To understand 
the articles’ relevance to this study, codes were initially established by 
analysing numerous abstracts and introductions of various IT governance 
research studies. Following the first analysis of the papers’ abstracts, the 
researcher created codes for the literature reviews, research methodology 
and results portions of the publications that were determined to be 
pertinent. 


It took organising, reading and analysing previous research papers 
and materials to get a full picture of the literature relevant to the IT 
governance sector. According to the location of the research study, 
research papers and documents were categorised, such as local, regional 
and international scholarly publications. Additional classifications were 
formed based on the locations of the prior studies, such as developed or 
developing nations. By identifying research gaps around IT governance, 
the research question was refined and further developed. A preliminary 
list of IT governance structures, processes and relational mechanisms, 
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and an initial list of IT governance facilitators and inhibitors were all 
revealed. Renner, Muller and Theissler (2022, p. 1896) outlined the 
following procedures for finding and conducting a review of the 
literature: (1) identify important terms to employ in the research; (2) 
locate literature about a topic by reviewing multiple forms of material 
and databases; (3) select and critically assess the literature for review; 
(4) sort the chosen literature; and (5) compose a literature review that 
presents literature summaries. 


Additionally, studies that are pertinent to the current investigation 
and are directly related to it were reviewed. Results from studies 
conducted internationally, regionally and nationally that covered the 
domains were critically analysed and arranged in accordance with the 
goals of the study. To examine and contrast the approaches, shortcomings 
and strengths in their study techniques and conclusions, comparable 
studies were grouped together by topics. A justification for the 
current investigation was finally provided by the identification of the gap 
in the literature and connections between earlier studies on the 
phenomenon. 


Enterprise governance 


Enterprise governance, according to the Information Systems Audit and 
Control Association (ISACA 2014, p. 7), is a series of responsibilities and 
procedures carried out by the board and executive management with the 
objectives of giving strategic direction, ensuring that objectives are met, 
ensuring that risks are handled effectively and confirming that the 
company’s resources are used responsibly. Corporate governance and 
company governance fall under the broad category of enterprise 
governance. Business governance focuses on performance, whereas 
corporate governance primarily focuses on conformity, which takes a 
historical perspective. Enterprise governance concerns cannot be 
understood without taking IT into account because businesses heavily rely 
on it. Information technology governance is further driven by enterprise 
governance (ISACA 2014, p. 2). As a result, IT governance is an essential 
component of the larger organisational governance rather than existing as 
a separate endeavour. 


Business governance 


The performance aspect of the organisation is the main emphasis 
of business governance. Business governance places a strong 
emphasis on strategy and value creation, as well as on assisting the 
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board in making strategic decisions, comprehending its risk appetite 
and key performance drivers, and identifying its key decision-making 
points, according to ISACA (2014, p. 7). Business governance, unlike 
corporate governance, lacks specific oversight structures like audit 
committees. 


Corporate governance 


The connections and mechanisms that influence a company’s 
performance and direction are referred to as corporate governance 
(Goosen & Rudman 2013, p. 835). It is described as a situation where 
others can successfully perform their jobs by Sohal and Fitzpatrick 
(2002, p. 97). Organisational policies, structures and management 
procedures are included in this (Schwarz & Hirschheim 2003, p. 130). 
Corporate governance, also known as compliance, according to ISACA 
(2014, p. 7), deals with matters pertaining to the structure and makeup 
of the board, as well as its tasks and obligations, as well as executive 
compensation. Well-established supervision procedures for the 
corporation can help to foster good corporate governance. The challenge 
of developing mechanisms and frameworks to enable effective and 
efficient use of organisational resources for generating stakeholder 
value is central to all definitions of corporate governance. The definitions 
place a strong focus on accountability, authority and the decision- 
making processes. 


Relationship between corporate governance and 
information technology governance 


The focus of IT governance is on the corporate governance framework’s 
parts that are related to IT (Kan 2003, p. 2). Young, Ridley and Carroll 
(2014, p. 239) suggest that IT governance is merely one aspect of 
corporate governance, which supports Kan’s (2003) claim. The idea that 
IT governance cannot be administered independently from corporate 
governance was alluded to by Wu, Straub and Liang (2015, p. 498) and 
Exler (2003, p. 1), who emphasised that the outcomes may be disastrous 
when IT and corporate governance go awry. This study demonstrates 
how relevant an element of overall corporate governance and IT 
governance is. Weill and Ross (2004a, p. 5) strengthened earlier claims 
in their study by creating a framework to provide evidence of the 
connection between corporate and IT governance. This relationship is 
shown in Figure 2.1, which was taken from Weill and Ross (2004, p. 5) 
and mentioned by ISACA (2014, p. 8). 
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Senior executive team 
Strategy + Desirable behaviour — 
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IT assets assets 
Finance governance mechanisms IT governance mechanisms 
(committees, budgets, etc.) (committees, budgets, etc.) 


IT governance 


Source: Weill and Ross (2004, p. 5). 
Key: IP, intellectual property; IT, information technology. 


FIGURE 2.1: Relationship concerning corporate and information technology governance. 


Governance of information technology 


Over the past ten years, a variety of arguments have been made on IT 
governance. For example, Van Grembergen (2004, p. 4) defines IT governance 
as the organisational power used by the board, executive management and 
IT management to oversee the development and execution of IT strategy 
and, in so doing, guarantee the alignment of business and IT. Under the same 
token, Weill and Ross (2004, p. 2) argue that IT governance is defining the 
framework for responsible decision-making and accountability to promote 
desired IT use behaviour. The propositions made by ITGI (2003, p. 10), Van 
Grembergen (2004, p. 4) and De Haes and Van Grembergen (2015, p. 2) that 
IT governance, which is a crucial component of enterprise governance, 
consists of organisational and leadership structures and procedures that 
guarantee the organisation’s IT sustain and support its strategy and goals 
converge and are generally accepted. 


Lee and Lee (2008, p. 47) comprehensively divided the three views that 
they used to summarise their literature review study on IT governance into 
decision-making authority and accountability, business and IT strategic 
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alignment, and organisational relationships. The initial perspective 
emphasises IT governance as a focal point for decision-making in 
organisations, outlining the roles and responsibilities of various stakeholders 
in IT-related choices. The arguments of ITGI (2003, p. 10), Peterson (2003, 
p. 37), Simonsson and Ekstedt (2006, p. 18) and Weill and Woodham (2002, 
p. 1) are in alignment and support Lee and Lee’s first assertion. The 
succeeding perspective that focuses on the objective of realising strategic 
alignment concerning business and IT is supported by Van Grembergen 
(2004, p. 7) and De Haes and Van Grembergen (2015, p. 4). The ITGI (2003, 
p. 10) definition of IT governance as the duty of executives and the board 
of directors to provide direction, establish organisational frameworks 
and implement procedures that guarantee the organisation’s IT supports 
and advances its strategy and goals lends support to Lee and Lee’s 
third perspective. 


There exists acknowledgement of various definitions of IT governance in 
the literature. However, they frequently focus on and converge on the 
location of IT-related decision-making rights and duties and emphasise on 
the need to achieve a strategic alignment between IT and business. The 
board of directors and management, who are solely responsible for its 
adoption and implementation, enable IT governance, which attempts to 
create a link between business and IT. Additionally, IT governance aims to 
guarantee the delivery of IT value (De Haes & Van Grembergen 2015, p. 6). 
Emphasis is given by Kan (2003, p. 2), who argues that IT governance 
enables the delivery of desired IT value for the long-term performance of 
the organisation, which is in line with previous propositions. 


On a similar note, Symons (2005, p. 6) emphasises that risk connected 
with business is the same as risk related to the usage of IT and that it needs 
to be addressed, and risk mitigation is another crucial component of IT 
governance. As such, IT governance also encourages accountability. 
Peterson (2003, p. 41) promotes that IT governance is centred around IT 
decision-making rights and duties and supports the aspect of accountability. 
These sections discussed the background of IT governance in comparison 
to other forms of governance. The literature discussion provided evidence 
that no consensus exists on the definition of IT governance (Jokonya 2014, 
p. 21; Pereira, Almeida & Da Silva 2014, p. 4386). The following section 
presents and discusses some of the frameworks used by organisations in 
implementing IT governance as an innovation. 


Standards and frameworks for information 
technology governance 


To help organisations with their IT governance, management and 
accountability, several industry-specific IT governance frameworks and 
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standards have been created and are advised for use by organisations. 
Establishing and enhancing procedures and practices for efficient IT 
governance require a fundamental understanding of the frameworks, 
standards and practices, as well as the guiding ideas behind them (ISACA 
2014, p. 9). The most popular framework for implementing IT governance 
is COBIT. 


Control Objectives for Information and 
Related Technology 


Developed by ISACA, COBIT is a comprehensive IT governance framework 
that aids organisations in achieving their IT governance objectives. 
Organisations may derive the most value from IT by maintaining a balance 
between benefits, risks and resource usage. The framework can be 
integrated with a variety of IT governance programmes, including ITIL. 
According to COBIT, corporate governance is a necessary component that 
guarantees that the needs, circumstances and options of stakeholders are 
assessed to determine the balanced, predetermined corporate objectives 
to be met, establishing direction through decision-making and prioritisation 
and keeping track of performance and adherence to the predetermined 
path and goals (ISACA 2012, p. 14). 


The COBIT framework suggests 34 IT procedures in four categories, 
including organising and planning, purchasing and implementing, delivering 
and supporting, and monitoring (ITGI 2005, p. 2). Planning and organising 
address difficulties at the strategic level of the organisation, primarily 
concentrating on how IT can effectively and efficiently improve the 
accomplishment of strategic corporate objectives and goals. Acquisition 
and implementation largely address challenges related to the purchase, 
setup and integration of various IT systems and solutions with business 
operations. The scope of delivery and support includes concerns with 
service provision, IT system security, user onboarding training; and 
monitoring calls for independent audits of IT systems to find aberrations 
and offer ideas for improvement. It also entails managerial oversight of the 
organisation’s control mechanisms. The COBIT framework is undergoing 
improvements and has iterated since its inception, as demonstrated in the 
following section. 


O Control Objectives for Information and Related 
Technology development 


The COBIT framework was initially created in 1996, and the sixth edition of 
COBIT has subsequently been released. The sixth edition is an improvement 
over earlier iterations of the framework, and the evolution is depicted in 
Figure 2.2. 
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Source: Adapted from De Haes et al. (2020, p. 131). 
Key: IT, information technology; COBIT, Control Objectives for Information and Related Technology. 


FIGURE 2.2: Control Objectives for Information and Related Technology evolution. 


Control Objectives for Information and Related Technology 5, released by 
ISACA in 2012, is one of many best practice frameworks that have been 
created and advocated for use by management in establishing IT 
governance. Control Objectives for Information and Related Technology 
affords a comprehensive framework that aids organisations in realising 
their goals for IT governance and management. By preserving a balance 
between paybacks, risk levels and resource utilisation, COBIT helps 
organisations get the most value out of their IT (ISACA 2014, p. 8). Control 
Objectives for Information and Related Technology is complemented by a 
wide range of other industry frameworks, standards and procedures. These 
include the Committee of Sponsoring Organizations of the Treadway 
Commission (COSO), ITIL and the International Organization for 
Standardization (ISO) 38500. The motivations behind organisations 
implementing IT governance are covered in the section that follows. 


Although the aforementioned IT governance frameworks are available 
in the market, most of them have difficulties in their implementations (Teo, 
Wei & Benbasat 2013, p. 2). Prior to this, ITGI (2011, p. 2) and Zhang and Le 
Fever (2013, p. 391) noted that organisations continue to experience IT 
challenges despite the literature on IT frameworks being available as 
supported by Jokonya (2014, p. 20). Despite the usefulness of good IT 
governance standards, frameworks and solutions, studies show that just a 
small fraction of organisations really use such IT governance frameworks 
C(ITGI 2011, p. 2). As expected, effective IT governance frameworks and 
solutions adoption has been shown to be even less prevalent in emerging 
nations (ITGI 2008b, p. 1). The motivations behind IT governance in 
organisations are covered in the section that follows. 
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Information technology governance drivers 


Information technology governance drivers are factors that encourage 
businesses to implement IT governance. This is mandated by several IT 
governance drivers in the shape of numerous difficulties and opportunities 
(Hoving 2007, p. 147; Luftman & Kempaiah 2007, p. 129). Recognising IT 
governance drivers in the internal and external environment is essential 
given the constantly shifting business and economic situations (ISACA 
2014, p. 10). The requirement for new and updated IT governance policies 
is determined by drivers, which are often known as pain points or trigger 
events. In their assertion that one model of IT governance is IT adaptation 
to tactical and environmental constraints, Schwarz and Hirschheim (2003, 
p. 131) reinforced this notion. 


To aid organisations in adopting andimplementing IT, several frameworks, 
standards, practices and solutions have been proposed. However, these 
frameworks and practices emphasise that how a practice is implemented 
will depend totally on the circumstances of the organisation. Numerous 
reasons may indicate the need for updated or new IT governance practices. 
However, given the heterogeneity of operating environments, no 
recommendation is made as to why, which and how practices should be 
chosen and implemented by concerned organisations (Lunardi, Becker & 
Maçada 2009, p. 2; Pereira & Mira Da Silva 2012, p. 343). 


The need for new or updated IT governance procedures may arise as a 
result of pain points or trigger events, according to ISACA (2014, p. 10). 
Pain points are instances where a company suffers financial losses as a 
result of poor IT governance procedures. A pain point, for instance, is when 
a company is growing its IT spending but the benefits of that spending and 
the performance of that spending are not carefully considered or fully 
acknowledged. In a situation like this, where business and IT do not share 
the same perspective, it may be an indication that IT governance concerns 
are not being adequately addressed. When it comes to implementing IT 
governance, pain points are literally signs of bad IT governance practices. 


Along with the pain points, other aspects of the internal and external 
environments of the organisation can draw attention to IT governance and 
motivate its implementation. The introduction of a new regulatory or 
compliance mandate, a merger, acquisition or divestiture are a few examples 
of what ISACA refers to as trigger events. An organisation might adopt a 
new business strategy, which might then affect how IT decisions are made. 
The claims made by ISACA are consistent with literature, which asserts that 
both external and internal challenges make the implementation of IT 
governance necessary (Xue, Liang & Boulton 2008, p. 70). Hoving (2007, 
p. 153) contends that numerous IT governance drivers in the form of varied 
difficulties and expectations demand IT governance adoption. Schwarz 


21 


Theoretical Perspectives 


and Hirschheim (2003, p. 131), however, reiterate that the IT response to 
strategic and environmental imperatives is one construct of IT governance. 


ISACA (2014, p. 12) continue by stating once more that organisations 
should start by identifying the present IT governance pain spots or trigger 
events. The requirement for bettering or adopting new IT governance 
procedures is driven by these pain points and trigger events, which serve 
as IT governance drivers. The findings of earlier studies about the 
motivations for IT governance are discussed in the section that follows. 


E Prior research on drivers for information 
technology governance 


For writing this book, several earlier works in the field of IT governance were 
evaluated. These studies were categorised in terms of international, regional 
and local scholarly work. In their governance survey of 168 different 
organisations in the public and private sectors, Guldentops, Van Grembergen 
and De Haes (2002, p. 34) claim that these organisations are driven by 
various factors such as reputation and conviction, regulatory compliance, 
performance enhancement, risk reduction, cost cutting, mission and goals, 
corporate values, competitive environment and external political or 
economic environment. They found that the fulfilment of higher-order 
needs, which decide the strategic direction of the organisations, is a 
driver for IT governance in their research organisations. According to other 
separate studies, organisations’ deployment of IT governance is mostly 
motivated by the desire to comply with laws and regulations (De Haes & 
Van Grembergen 2006a, p. 3). De Haes and Van Grembergen highlighted 
several factors for IT governance in their pilot case research study on IT best 
practices in Belgian organisations. The most crucial one was that Belgian 
organisations must abide by Sarbanes-Oxley regulations. 


The most important factor influencing the governance of enterprise 
information technology (GEIT) projects, according to a poll by ITGI (201), 
p. 4), in The Global Status Report on the Governance of Enterprise IT, is 
making sure that the present IT functionality aligns with current business 
needs. Cost management was the second most mentioned driver. Following 
mergers and acquisitions, economic pressures and the urge to achieve 
economies of scale were additional significant drivers. The avoidance of 
unfavourable incidents, striking a balance between innovation and risk 
avoidance to further returns on IT investments, and, finally, compliance 
with industry and governmental rules were some other motivations that 
were noted. Both ITGI (2011, p. 4) and De Haes and Van Grembergen (2006, 
p. 3) concurred that the demand for IT governance is driven by regulatory 
compliance. However, the ITGI poll used a closed questionnaire, which does 
not allow for fresh perspectives. Respondents were only allowed to select 
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from the available alternatives. The survey’s strength was that ITGI studied 
both government-owned and privately-owned businesses, as well as small 
and large businesses. 


Additionally, an exploratory study by Wibowo and Yuwono (2008, p. 1), 
based on eighteen instances in Indonesia, shows that there are a number of 
variables that motivate Indonesian organisations to better manage their IT. 
Wibowo and Yuwono (2008, p. 6), while agreeing with De Haes and Van 
Grembergen (2006, p. 3), assert that the forces influencing IT governance 
include the free market and competition, shareholder and director pressure 
regarding accountability for significant IT investments, strict regulations, 
the need for accountability and transparency, pressure from business 
partners, and mergers and acquisitions. Despite the study being primarily 
qualitative, competition and market constraints seemed to provide a crucial 
urgency and motivation for stronger IT governance. 


It is clear from an analysis of the studies on the factors influencing IT 
governance that adherence to external legal and contractual requirements 
predominates the research results. However, most of the research was 
conducted in developed economies, which can have different corporate 
operating settings than a developing nation like South Africa. Furthermore, 
literature, paradigms and methods fail to provide a straightforward and 
succinct documentation of these drivers. Each organisation operates in a 
context that is distinct from another; this context is determined by internal 
and external factors, including organisational culture, risk appetite and 
changing business strategies. As a result, each organisation needs its own 
governance framework (ISACA 2014, p. 45). The need for an investigation 
and formalisation of these driving forces (drivers) for IT governance 
implementation in private and public health care sectors in South Africa is 
pushed by the heterogeneity of organisational needs, such as the 
expectation that not all organisations implement IT governance for the 
same reasons. Following this explanation of the motivations behind IT 
governance, the following section discusses how organisations might put 
IT governance into practice. 


E implementing information technology 
governance 


Information technology governance implementation comprised of a variety 
of different structures, processes and relational mechanisms, as theorised 
in the literature by Peterson et al. (2002, p. 563), Peterson (2003, p. 37), 
Van Grembergen, De Haes and Guldentops (2004, p. 7), Weill and Ross 
(2004, p. 8) and De Haes and Van Grembergen (2015, p. 11). Figure 2.3 
displays the framework. The development and position of the IT function, 
the presence of well-defined roles and tasks, and the variety of IT and 
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Structures Processes 
¢ Roles and responsibilities * Strategic information systems planning 
¢ IT organisational structure ¢ IT BSc, COBIT and ITIL 
* CIO on board e Information economics 
¢ IT strategy committee * Service level agreements 
¢ IT steering committee ¢ IT alignment and governance maturity 
models 


IT governance framework 


i 


Relational mechanisms 


¢ Active participation and collaboration between principal 
stakeholders 

¢ Participation rewards and incentives 

e Business and IT co-location 

* Cross-functional business and IT training and education 


Source: De Haes and Van Grembergen (2015, p. 12). 
Key: IT, information technology; CIO, chief information officer; BSc, Bachelor of Sciences degree; COBIT, Control Objectives 
or Information and Related Technology; ITIL, Information Technology Infrastructure Library. 


FIGURE 2.3: Elements of information technology governance framework. 


business committees are all examples of structures. The phrase structural 
(formal) devices and processes for linking and permitting horizontal, or 
liaison, interactions between business and IT management (decision- 
making) functions is used by Peterson (2003, p. 37) to describe IT 
governance structures. Structures such as the IT organisational structure 
and IT committees are concerned with who makes the IT decisions (De 
Haes and Van Grembergen 2015, p. 11). 


On the other hand, processes entail tactical decision-making and the 
application of several IT governance and management standards (such as 
COBIT and ITIL), giving organisations a means of gauging the value that IT 
adds to the process (De Haes and Van Grembergen 2015, p. 11). The 
implementation and institutionalisation of strategic IT decision-making or 
monitoring techniques, such as the IT balanced scorecard, COBIT and ITIL, 
according to Peterson (2003, p. 38), constitute the IT governance process. 
Finally, relational mechanisms are the dynamic affiliations between 
company leaders, IT management and business management (Peterson 
2003, p. 39). Relational mechanisms support strategic dialogue between 
business and IT as well as group learning. Training, job rotation and co- 
location are a few examples of relational mechanisms. These procedures 
make sure that the organisation as a whole and IT are effectively 
communicating and achieving business-IT alignment. An illustration of the 
components of an IT governance framework may be found in Figure 2.3. 
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Figure 2.3, taken from De Haes and Van Grembergen (2015, p. 12), illustrates 
how a framework can contain structures, processes and relationship 
mechanisms. The components of a framework are further discussed in the 
sections that follow. 


E information technology governance 
structures 


Organisational entities and the roles involved in making IT decisions - that 
include approving contracts between business and IT - are included in IT 
governance structures. The steering committee is one such ISACA (2014, 
p. 12). The organisation of the governance framework is laid out in the 
structures. In addition, the organisation of the IT department, its roles in 
decision-making and its relationships with other organisational departments 
are allincluded in IT governance frameworks. The IT department is segregated 
from other organisational departments in the most widely used and 
traditional IT structure. In this model, the IT department serves as the primary 
processing location for all IT-related issues that affect the entire organisation. 
Incontrast, organisations can use a decentralised strategy. Each organisational 
department must have its own IT staff in order to do this. Some businesses 
combine centralised and decentralised IT structures. This is a scenario when 
the company has a centralised IT department, and IT staff simultaneously 
support other departments. Another method by which businesses are 
organising their IT departments is by outsourcing non-essential IT services 
while maintaining core IT services. There is no required IT structure, and the 
option will largely depend on the skills, aims and goals of the organisation. 


Roles and responsibilities 


The board and management are responsible for disseminating information 
about the duties and responsibilities so that the involved organisations can 
comprehend them clearly. Roles and responsibilities should be clearly defined. 


Organisational structure for information 
technology 


The effectiveness of IT governance depends on how the IT function is 
organised within a company. 


Chief Information Officer on board 


The chief information officer (CIO), among other stakeholders, plays a 
significant role in ensuring IT governance and frequently updates the board. 
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Committee for information technology strategy 


To provide direction, review and amendment of business and IT strategies, 
the IT strategy committee collaborates closely with other board committees 
and management committees. Operating at the board level is the IT 
strategy committee. 


Information technology steering committee(s) 


The IT steering committee is in control of overseeing major initiatives, IT 
priorities, budgets and resource distribution. The executive management 
level is where the IT steering committee operates. 


Information technology governance processes 


To guarantee that regular behaviour is harmonised with policies and 
influences the decisions, IT governance processes solemnise and 
institutionalise strategic IT decision-making and monitoring processes 
(ISACA 2015, p. 12). Processes such as the balanced scorecards and service 
level agreements use a variety of frameworks and technologies as discussed 
below. 


Strategic information systems planning 


One of the most crucial aspects of IT governance, strategic information 
systems planning harmonises IT and business. It makes the connections 
between business and IT very evident. 


Service level contracts 


Service level agreements define the level of service that users are expected 
to receive from the service provider, together with the degree of service 
that the provider can provide. The mutual agreement covers the monitoring 
of delivered services, difficulties encountered during delivery and the 
creation of improvement plans. 


Information technology governance relational 
mechanisms 


Relational mechanisms, which include publications, campaigns and 
awareness initiatives, are solely about corporate executives, IT management 
and business management, claims ISACA (2014, p. 12). However, research 
shows that the implementation of IT governance is contingent on a variety 
of different interior and peripheral elements. In this context, Ribbers, Peterson 
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and Parker (2002, p. 1) and Patel (2004, p. 82) contend that identifying the 
combination of implementation methods is a complex process that depends 
on several organisational aspects. These scholars also contend that despite 
being in the same industry, the ideal combination will differ from organisation 
to organisation. Even though they are in the same industry or sector, what 
benefits one organisation may not necessarily benefit another (Patel 2004, 
p. 82; Ribbers et al. 2002, p. 1). This suggests that various organisations may 
require a distinct mix, or dissimilar set, of structures, procedures and social 
mechanisms to meet their needs (Patel 2004, p. 82). This part covered the 
components of an IT governance framework, while the section that follows 
concentrates on earlier relevant studies on IT governance. 


Active participation by principal stakeholders 


Having a comprehensive grasp of how IT fits into the business, all 
stakeholders engage in making IT decisions. 


Partnership incentives and rewards 


The procedures examine the amount of business perception of IT value as 
well as the percentage of senior management IT literacy and senior IT 
managers’ business understanding. 


Information technology and business co-location 


Co-location helps to close the gap between business and IT by ensuring 
that IT staff members are seated next to their business counterparts, giving 
them a better understanding of the organisation. 


Cross-functional business and information 
technology training job rotation 
Employees from the business are frequently transferred to the IT department 
to have an improved comprehension of the IT side of the company. 


Additionally, to help IT staff members better understand the operational side 
of the company, they are temporarily transferred to other business areas. 


E Previous scholarship on the 
implementation of information 
technology governance 


The previous sections discussed elements of IT governance. This section 
discusses previous studies on IT governance implementation. One example 
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is a case study titled /T Governance Structures, Processes and Relational 
Mechanisms by De Haes and Van Grembergen from 2005. The study, 
Achieving IT and Business Alignment in a Major Belgian Financial Group, 
covered a single case and used in-depth interviews with IT and business 
representatives to collect data. Reports and other secondary data sources 
were also used to acquire data. The research organisation employed IT 
governance using a mix of structures, processes and relational mechanisms, 
according to their findings. 


The Malaysian Ministry of Education employed particular attributes of IT 
governance through a mixture of processes, structures and relational 
mechanisms, according to Ismail, Alias and Rahman (2008, p. 2) in their 
study on /T Governance Implementation in the Malaysian Ministry of 
Education. Their findings converge with the findings reported by De Haes 
and Van Grembergen (2004, p. 7) in their earlier study. However, the 
research organisation in Malaysia did not completely comprehend IT 
governance. This Malaysian study is important to this study because it was 
carried out in Malaysia, a developing economy like South Africa, and it 
examined the phenomenon from the public sector’s perspective, which is 
distinct from the financial services sector examined in the Belgian study 
that was previously mentioned. 


An Exploratory Study into IT Governance Implementations and Its Impact 
on Business and IT Alignment was another study by De Haes and Van 
Grembergen (2009, p. 2) that began with a literature review on IT 
governance and business and IT alignment and was supported by numerous 
interviews with business and IT decision-makers. Their research is pertinent 
because it addressed a query that was closely connected to one of the 
sub-questions that this study aims to address. However, their analysis was 
primarily focused on the Belgian financial services industry, which differs 
from the South African health care industry in several ways. Their research 
shows that businesses use structures, processes and relational mechanisms 
to establish IT governance. Information technology steering committees, 
CIO or executive committees, portfolio management, IT budget control 
and reporting, and IT strategy committees at the level of the board of 
directors were the top five practices for IT governance highlighted in the 
survey. The results concur with those of their earlier study (De Haes & Van 
Grembergen 2015, p. 4). 


The South African public health care sector is having difficulty in 
implementing the IT governance best practices, as stated in the problem 
statement in Chapter 1, even though IT governance may be implemented in 
a diversity of approaches that are obvious in the literature. Researchers’ 
failure to thoroughly investigate IT governance concerns in the health care 
industry is cause for concern. There are publications in the literature that 
primarily analyse IT governance in organisations that provide financial 
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services, but it seems that little research has reached the business level in 
the health care industry. Indeed, research has demonstrated that there is 
no predetermined ideal IT governance structure, and this is because a 
problem-solving strategy for an organisation is required by driving factors 
(Brown & Grant 2005, p. 707; Weill & Ross 2004, p. 9). Even though they 
may be in the same industry, what is the best plan for one company may 
not be the best strategy for another (Patel 2004, p. 82; Ribbers et al. 2002, 
p. 3152). Suomi and Tähkäpää (2004, p. 369) made a strong case for the 
idea that differences between public and private health care sectors impact 
on the applicable IT governance structure. Therefore, organisations use IT 
governance in different ways accordingly. This study affords a solution to 
the research question about IT governance in South African health care. 


Reviewing some of the inhibitors, also known as challenges or barriers, 
that some organisations have run into when establishing IT governance is 
crucial. Even though the focus of this study is mostly on IT governance 
inhibitors, understanding IT governance enablers is essential because some 
claim that the absence of enablers leads to inhibitors. The section that 
follows offers an overview of the IT governance barriers and opportunities 
mentioned by earlier academics from various organisations, businesses 
and nations. 


E Inhibitors to information technology 
governance 


The obstacles that could impede the implementation of IT governance or 
render it unsuitable for the organisation can delay, postpone or otherwise 
affect the process. The establishment of a comprehensive IT governance 
system faces obstacles from inhibitors. They can be regarded as anything 
that could prevent an organisation from achieving its goals. Enablers, on 
the contrary, are the elements that make it simple for organisations to 
embrace and use IT governance. Regarding the factors influencing the 
implementation of IT governance, several research studies have been 
published. Some of these studies have explicitly examined the phenomenon 
of inhibitors and facilitators, barriers, problems and from the point of view 
of the essential elements. Results from earlier studies on IT governance 
inhibitors are discussed in the section that follows. 


Previous research on the inhibitors to information 
technology governance 


A study on the barriers to and facilitators of business and IT alignment was 
conducted by Luftman, Papp and Brier (1999, p. 2). Their work is significant 
and pertinent to the current investigation because it examines the variables 
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that influence and prevent strategic alignment, one of the goals of IT 
governance. According to their research, social and management problems 
rather than technological ones are the main hindrances to business and IT 
strategy alignment. There appears to be widespread consensus that 
managerial-focused factors hinder IT governance (Weill & Broadbent 1998, 
p. 4). Further, according to Luftman et al. (1999, p. 23), if the effects of 
enablers are maximised and those of inhibitors are minimised, organisations 
can better align IT with other business processes. Teo and Ang (1999, 
p. 178) examined 168 organisations in various sectors for information system 
CIS) planning alignment over the same year. They discovered that the most 
crucial element in ensuring business-IT planning alignment is managerial 
commitment. Their emphasis on management commitment and support as 
the most important component for business-IT alignment aligns their 
findings with those of Luftman et al. (1999, p. 16). Luftman et al. (1999, 
p. 16) emphasise that managerial commitment and support are seen as 
enablers, whereas their absence is seen as an inhibitor. According to their 
analysis, business and IT cooperation is crucial for fostering IT governance 
and strategic alignment. 


An international survey of ClOs was done by PricewaterhouseCoopers 
(PWC) on behalf of ITGI in 2008. Their research identifies a number of 
variables that may prevent or facilitate the establishment of IT governance. 
The ITGI’s study findings show that organisations have powerful forces that 
can prevent the implementation of IT governance. For IT governance to be 
facilitated, these forces must be recognised and addressed. According to 
their analysis, IT governance is hindered by culture, resistance to change, 
lack of effective communication, internal politics, resistance to acceptance 
of standards and unwillingness to accept accountability (ITGI 2008b, p. 17). 


In their governance survey of 168 diverse establishments in the public 
and private sectors, Guldentops et al. (2002, p. 35) agreed with the findings 
of ITGI (2008b, p. 17). For instance, in the Guldentops et al. (2002, p. 33) 
study, a lack of ownership was closely linked to a lack of accountability 
acceptance. Numerous results continue to mention management 
commitment and involvement as potential enablers or inhibitors of the 
implementation of IT governance. Bowen, Cheung and Rohde (2007, 
p. 203) conducted an empirical in-depth investigation of the factors 
affecting IT governance structures, processes and outcomes. Their findings 
show a correlation between IT governance performance outcomes and 
shared business and IT objectives, active steering committee participation, 
a balance between IT and business representatives in IT decision-making, 
and well-communicated IT strategies and policies. 


Furthermore, Wibowo and Yuwono (2008, p. 6) identified various IT 
governance enabling and inhibiting elements based on an exploratory 
investigation of eighteen examples in Indonesia. The supporting and 
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understanding of executive management, the implementation of objective 
and performance-based management systems, and a thorough grasp of 
risk management are among the enabling aspects. Lack of IT leadership 
and the absence of defined procedures for establishing IT investment 
priorities are among the barriers. 


In their study on Challenges in Adopting and Integrating ITIL and CMMi 
in ICT Division of a Public Utility Company, Latif, Din and Ismail (2010, p. 84) 
identified several challenges specific to Malaysia. Absence of understanding, 
deficiency in standard terminology and absence of clearly defined roles 
and responsibilities were some of the difficulties. While this is going on, 
Jaafar and Jordan (2009, p. 43), whose analysis is likewise based on a case 
study of a government-affiliated corporation in Malaysia, show a lack of IT 
governance enforcement as a pertinent matter. 


This book can learn from another study by Othman et al. (2011, p. 1771) 
on Barriers to Information Technology Governance Adoption: A Preliminary 
Empirical Investigation, which was based on semi-structured interviews 
and examined a phenomenon in the setting of Malaysia, a developing 
nation. Additionally, this research made use of hypotheses that were utilised 
in this study. It demonstrates that most of the obstacles were in line with 
earlier research, which found that the majority of the crucial elements in 
rich countries were also supported as crucial elements in developing 
countries. The study went on to classify environmental context, 
organisational context, national context and practice context for IT 
governance as impediments to IT governance (Othman et al. 2011, p. 1775). 
Absence of senior management support, reluctance to change, insufficient 
awareness and training, and expertise were the main issues found (Othman 
et al. 2011, p. 1773). These elements, which were previously noted in earlier 
studies, are still seen as impediments to the adoption of IT governance. 


The study by Lee et al. (2008) on the causal relationship between IT 
governance inhibitors and its success in Korean enterprises is significant 
for this study because its subject and research design are nearly identical. 
The use of sequential mixed techniques, where the literature review serves 
as the foundation and the survey enters to support the findings from the 
literature, is described. They discovered five factors as the leading IT 
governance inhibitors through a combination of a literature review and a 
survey of 96 top companies in Korea, namely, poor communication, 
inadequate stakeholder involvement, lack of clear IT governance principles 
or policy, lack of clear IT governance processes and inadequate support of 
financial resources (Lee et al. 2008, p. 3). All these elements, according to 
Lee et al. (2008, p. 3), are thought to have a detrimental impact on the 
success of IT governance. A lack of clearly articulated policy has the 
greatest negative influence on the accomplishment of IT governance, 
according to the data gathered from various organisations in various 
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industries in Korea using a 5-point Likert scale questionnaire survey. It has 
been established that other impediments, including a lack of transparent IT 
governance procedures, poor stakeholder involvement and a lack of 
communication, also affect the success of IT governance in Korea. Their 
findings, however, indicate that a lack of funding had a less substantial 
impact on IT governance. 


The global status report on the GEIT by ITGI (2011) found that the most 
often cited obstacles (inhibitors) to the implementation of IT governance 
were communication, management change and attempting to accomplish 
too much at once (p. 2). Othman and Chan (2013) conducted a recent 
qualitative study titled Barriers to Formal IT Governance Practice: Insights 
from a Qualitative Study. Their findings show that public sector 
organisations exhibit more hurdles than private sector organisations, 
according to interviews with six public and three private organisations in 
Malaysia (Othman & Chan 2013, p. 4421). Their study has relevance to this 
study because it examined the same issue and was conducted in a 
developing nation. According to Othman and Chan, poor resourcing, 
insufficient expertise and skills, and lack of awareness were the biggest 
obstacles to IT governance (2013, p. 4421). The most important factors 
across all the organisations investigated were also shown to be a lack of 
time, human and financial resources. Additionally, organisations in the 
public sector were more blatantly lacking in knowledge and abilities. 
Their study discovered novel elements that were not discussed in the 
literature on IT governance. 


Nfuka and Rusu performed research in Tanzania within the context of 
southern Africa (2010). They identified eleven crucial success elements for 
efficient IT governance in Tanzanian public sector organisations through a 
literature review and case study of five organisations. The elements were 
clear IT goals and procedures, benefit definition and tracking and 
stakeholder involvement (Nfuka & Rusu 2010, p. 8). 


Letsoalo, Brown and Njenga (2006) did a case study on An Investigation 
of Enablers and Inhibitors of IT Governance Implementation: A Case Study 
of a South African Enterprise in the South African Environment. The study 
identifies critical enablers as senior management support, a project 
champion and external support based on the case study organisation and 
COBIT framework implementation. Lack of clearly defined IT procedures, 
improper budget allocation and poor stakeholder involvement were shown 
to be three major bottlenecks (Letsoalo, Brown & Njenga 2006, p. 32). 
Because the phenomenon under discussion in this study is the same as that 
in the research, it provides a solid foundation. However, because their 
analysis was focused on a single organisation, it is challenging to draw 
generalisations about the South African economy as a whole. 
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The research confirms once more that effective execution of the relevant 
change is a prerequisite for IT governance (ISACA 2016, p. 4). The adoption 
of IT governance has been identified as being dependent on change 
facilitation. This includes convincing the appropriate stakeholders to 
support the change and effectively managing the human, behavioural and 
cultural components of it (ISACA 2016, p. 6). Information Systems Audit 
and Control Association emphasises that in order to execute IT governance, 
the right environment and culture must be in place. The components of 
human behaviour need to receive enough consideration. Additionally, 
research shows that IT governance projects fail because of a lack of 
management oversight, support and direction, as well as an inappropriate 
cultural backdrop. When IT governance activities result in rules, processes 
and controls that lack adequate ownership, a lack of support and guidance 
from management and concerned stakeholders may result. Without 
ownership and a management structure that gives roles and duties, 
procedures are prone to develop into standard company practices with no 
roles and responsibilities. 


E Performance in information technology 
governance 


Information technology governance success is related to how well it 
promotes expected behaviour and, ultimately, the achievement of 
performance objectives inside the organisation (Nfuka & Rusu 2010, p. 2). 
Weill & Ross (2004, p. 3) define IT governance performance measures as 
the efficiency of IT governance in producing four results that are weighted 
according to their significance to the organisation: using IT in a cost- 
effective manner, utilising IT effectively for asset utilisation, effective use of 
IT for growth and using IT effectively for business flexibility. The next 
section discusses the theoretical frameworks that inform and direct the 
investigation. 


E Theoretical foundations and research plan 


The previous section covered a few topics related to IT governance and 
earlier studies in the field. The theoretical background is to assemble 
theoretical viewpoints on the theories surrounding the acceptance of 
innovations. The following section affords information on a discussion of 
the literature to find pertinent theories in the dissemination of innovation in 
information systems that can serve as starting points for future study. To 
guide the creation of the research framework for the examination of the 
current research problems, a case is made in favour of the theory that was 
chosen. 
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The literature on innovation diffusion reveals how ideas have been used by 
scholars to examine how technologies and technological advances are 
adopted. There are several frameworks in the literature that can be applied 
to helo respond to the research questions. Some theories are at the 
individual level and so consider how decisions are adopted by an individual, 
while other theories concentrate on how innovations are adopted by 
organisations. The implementation issues in health care are the main topic 
of this study. Therefore, theories at the individual level are inappropriate. 
As a result, organisational-level theories are applicable. The application of 
theory is driven by the quest to develop a preliminary framework that 
recognises prior understanding and formulates a meaningful theoretical 
foundation to illuminate the themes and methodologies of early empirical 
studies. 


E innovation frameworks for information 
technology 


Information technology governance is viewed by the adopting organisation 
as a fresh innovation (Damanpour & Evan 1984, p. 392). Othman et al. (2011, 
p. 1772), who view IT governance as an administrative innovation, place 
special emphasis on the character of the practice. To assess the IT 
governance barriers, the study first considered different IS paradigms for 
the acceptance and application of innovations in the literature. Their 
shortcomings and advantages were examined to determine whether they 
might be applied to the viewpoint of the current investigation. 


Technology-organisation-environment framework 


The TOE framework by Tornatzky and Fleisher (1990) offers a very analytical 
platform for examining how different IT advances have been adopted at 
the organisational level. The Diffusion of Innovations (DOI) theory (Rogers 
1995b, p. 27), which placed focus on how personal qualities, along with 
internal and external organisation variables, influence and affect an 
organisation’s capacity for innovation, is in line with the TOE framework. 
According to the TOE framework, innovation in organisations is built around 
three contexts: the organisational context, the technological context and 
the environmental context (Bose & Luo 2011, p. 39; Jokonya, Kroeze & Van 
Der Poll 2014, p. 1008; Tornatzky & Fleisher 1990, p. 150). 


Elements of the TOE framework are shown in Figure 2.4, which was taken 
from Tornatzky and Fleisher (1990, p. 152). The technological background 
gives an overview of both internal and external technologies that are significant 
to business, which include the company’s existing fundamental practices 
together with technologies that are available but not owned by the company. 
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Source: Tornatzky and Fleisher (1990, p. 152). 
FIGURE 2.4: The technology-organisation-environment framework. 


Organisational context denotes the elements that characterise an organisation, 
such as its size, breadth and managerial culture. These are the characteristics 
that describe an organisation, and they also consist of the poor quality of the 
human resources available within an organisation. The organisation is a wealth 
of formal and informal structures, procedures and cultural characteristics that 
direct the adoption of innovations (Tornatzky & Fleischer 1990, pp. 181-182). 
The term ‘environmental context’ denotes the surroundings in which an 
organisation operates and encompasses, including competition, resource 
availability and governmental, legal and regulatory influence (Haag & Eckhardt 
2014, p. 423; Tornatzky & Fleischer 1990, pp. 154-154). This is the broad 
environment in which the company operates. 


Even though the framework’s premises change between research 
projects, it nonetheless offers a solid theoretical foundation and broad 
applicability to other IS innovation domains. Similar justifications are given 
for the DOls theory. Despite the TOE framework encompassing the 
environmental context as a developing component, imposing both 
restrictions and potential for organisational innovation, the two theories 
contend both internal and external influences act as impediments to that 
innovation. The fact that the TOE framework is at the organisational level 
and allows for the simple insertion of additional components gives it an 
edge in the current research. 


Although it is a theory that can be used to analyse the implementation 
barriers to IT governance, using it as a stand-alone theory gives an 
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incomplete picture of the barriers to IT governance as a technological 
innovation. The TOE framework has been criticised for failing to adequately 
address matters that affect IT governance in organisations (Jokonya 2014, 
p. 19). As a result, this study considered and adopted the theoretical 
framework and extended it to the IT governance implementation domain. 
A discussion of the DOI theory is given in the section that follows. 


Diffusion of innovations theory 


The prior section deliberated on the TOE framework with respect to IT 
governance implementation in organisations. The DOI hypothesis, created by 
Rogers in 1995, is covered in this section. The DOI is one of the theories that is 
frequently used in research on the adoption of innovations. Several previous 
studies on innovation adopted the theory (Othman et al. 2011, p. 1775). 
Organisational innovativeness, according to the DOI theory, depends on a 
variety of elements, including qualities of the organisation’s leaders, internal 
organisational structures and external characteristics. According to Rogers’ 
(2003, p. 14) DOI theory, external and technological factors can have just as 
much of an impact on the acceptance of new technologies as organisational 
ones. Teo et al/s (2003, p. 21) institutional theory, which emphasises the 
significance of outside forces on technology, supports this argument. 


By emphasising technology-specific characteristics such as the complexity 
of the IS innovation itself, which plays a crucial role, Basaglia et al. (2009, 
p. 1) add to scholarly discussions on the adoption of IS innovations. The DOI 
is crucial for understanding the propagation of innovations from both the 
perspectives of individuals and the organisation (Jokonya 2014, p. 17; Oliveira 
& Martins 2011, p. 111). The DOI is pivotal for understanding the organisational 
environment of innovation. Figure 2.5, which was adapted from Rogers 
(1995, p. 26), displays the diagrammatic presentation of the DOI. 


This application of the DOI has been criticised for not being able to 
forecast the acceptance of complicated inventions when used as a stand- 
alone theory (Othman et al. 2011, p. 1775). The theory has been criticised for 
not giving enough thought to technological component of the innovation 
process (Jokonya 2014, p. 16). The critique is that organisational IT 
innovation goes beyond technical factors to consider the social, economic 
and political variables (Jokonya 2014, p. 16). Having learned from the 
arguments, it might be claimed that DOI theory needs to be blended with 
other theories to include more imperative factors. 


It was crucial for the researcher to combine the two theories, which led to 
the addition of DOI constructs to the TOE framework components. Combining 
some of its components with the TOE framework results in two thorough 
lenses to analyse the barriers to implementing IT governance. Although the 
TOE framework and the DOI are identical, the TOE framework goes beyond 
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FIGURE 2.5: Diffusion of innovations theory. 


the DOI in that it also considers the environmental context, which presents 
opportunities and barriers for technological growth. The prior IS or IT 
adoption and implementation literature at the organisational level provided 
guidance for the collection of theories used in this study. The theories and 
subsequent mapping implementation of IT or IT innovations and systems 
were carefully considered when choosing the constructs. 


Frameworks in the context of information 
technology governance inhibitors 


This study applies the TOE framework and the DOI theory as lenses to 
analyse the barriers to IT governance. The technological context, 
organisational context and environmental context are the three components 
that come from the application of the DOI theory and the TOE theory, and 
they are all influential in how the firm applies technology breakthroughs. 
The researcher characterised the IT governance context to represent the 
technological context in order to conceptualise and operationalise the TOE 
framework. The resulting three contexts, namely, the IT governance context, 
organisational context and environmental context, represent the framework 
in this study. The three contexts are further discussed in the sections below. 


E Information technology governance 
context 


A key factor in determining how an IT governance framework or standard 
is implemented is its quality and characteristics, which are defined in this 
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study within the context of IT governance practice. These characteristics 
include their complexity, implementation expense and accessibility. 
Complexity is the difficulty in comprehending how an innovation is 
implemented (Rogers 1995, p. 25, cited by Othman et al. 2011, p. 1777). It 
may be ingrained in how users perceive an invention and their openness to 
accepting it. The likelihood that an idea will be accepted, adopted and put 
into practice decreases as it becomes more complex. Cooper and Zmud 
(1990, p. 128) discovered that more complex information systems may 
prevent their acceptance and spread. In their study, ITGI (2008, p. 2) 
demonstrated how complexity directly affects whether IT governance 
techniques are adopted. It becomes challenging to integrate innovation 
considerations with other organisational components. 


The degree to which the organisation understands the complexity of the 
IT governance phenomenon, together with the standards and frameworks 
for IT governance, makes it vital to determine whether this may be affecting 
their implementation of IT governance through this study. The literature 
also shows that decisions to accept innovations are influenced by the 
associated costs of adoption and implementation. The same complaint has 
been made regarding the application of IT governance practices (Winniford, 
Conger & Erickson-Harris 2009, p. 158, cited by Othman et al. 2011, p. 1772). 


Organisational context 


The elements that can be directly linked to the organisation itself are 
referred to as organisational context factors. These elements include formal 
and informal structures, communication procedures, organisational scale, 
the availability of spare resources for the implementation of innovations, 
decision-making processes, the quality of Numan resources and the 
complexity of managerial structures. Processes for making IT decisions are 
influenced by organisational traits and internal IT function organisation 
(Xue et al. 2008, p. 68). According to information system literature, 
organisations with decentralised organisational structures have 
decentralised IT governance structures, while those with centralised 
organisational structures have central IT decision-making structures (Xue 
et al. 2008, p. 72). 


The literature has shown that resources, such as time and human 
resources, have a crucial impact on the implementation of innovations. A 
direct correlation exists between the capability of human resources and 
the practice of IT governance, according to Spremié (2009, p. 908). Time 
has been shown to be a barrier to the implementation of IT governance 
(Lee et al. 2008, p. 10, cited by Othman et al. 2011, p. 1781). This study will 
determine whether a lack of resources is impeding the adoption of 
IT governance in the health care industry. For an IT governance standard or 
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new practice to be implemented successfully, communication is crucial 
both within and across departments, units and the organisation. 


Foranorganisationto avoid problems with|IT governanceimplementation, 
having a shared, comprehensive understanding of the practice or innovation 
and taking ownership of it becomes essential. The organisation’s many 
divisions and levels must continue to communicate with one another. 
Literature reveals that effective communication is necessary for the 
adoption of IT governance to be successful (Bernanda & Michelle 2021, 
pp. 90-92; ISACA 2014, p. 2; ITGI 2008, p. 94; Joshi, Bollen & Hassink 2013, 
p. 116; Wilkin & Riddett 2009, p. 353). It has been demonstrated that 
formalisation, particularly administrative innovation, has a favourable 
impact on the adoption of innovations (Zmud 1982, p. 1424, cited by 
Othman et al. 2011, p. 1778). Innovation implementation has fewer difficulties 
for more formalised organisations. Furthermore, it has been noted that an 
essential factor in determining an organisation’s capacity for innovation is 
its size. It is argued that larger organisations, which have access to more 
financial and human resources, are more capable of innovating than smaller 
businesses. 


Processes and employee routines in organisations alter as a result of 
innovation. The adoption of such ideas unquestionably necessitates a 
willingness to challenge deeply ingrained norms. Implementing IT 
governance may result in new structures and altered business procedures, 
both of which need adaptable attitudes. The governance of IT is hampered 
by a lack of change. 


E Environmental context 


Clients, competitors, business partners, the government and other external 
stakeholders that have an impact on an organisation’s decision-making 
procedures and internal business operations are included in the 
organisation’s external environment. Government regulations, industry and 
market characteristics, competitors, outside support from IT governance 
specialists and consultants, as well as the overall infrastructure supporting 
IT governance all have a significant role in aiding or impeding the adoption 
of IT governance. The way that IT processes are managed within 
organisations is directly impacted by the rapidly evolving IT environment 
(Benamati & Lederer 2001, p. 2, cited by Xue et al. 2008, p. 71). This study 
limits the external environment to only include government regulation, 
industry market characteristics, IT experts and consultants, and IT 
governance infrastructure, which is in line with the TOE framework. 


Technology developments and standards are implemented in large 
part as a result of laws and regulations. Because of the strong government 
regulations on governance, particularly in developed economies, 
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IT governance has been put into place. Previous studies have shown that 
market and industry characteristics also influence how standards are 
implemented. Some studies show a direct link between the application 
of standards and the sector or industry that derives maximum utility 
from them (Othman et al. 2011, p. 1782). This is emphasised by 
Campbell et al. (2010, p. 5), who contend that the implementation of 
IT governance differs across private and public organisations. 
Support from outside groups that provide standards is essential. Support 
may take the form of providing skills, knowledge, hardware and software 
required for the implementation of IT governance. It has been noted 
that in order for organisations to adhere to their own IT governance 
principles, vendor and consultant commitment is essential (Othman 
et al. 2011, p. 1781). 


Previous studies exploiting the technology- 
organisation-environment framework 


Researchers like Oliveira and Martins (2011, p. 112) in their study on 
e-business used the TOE in a number of prior IS innovation adoption 
and implementation studies. In order to provide comprehensive lenses 
for the phenomenon under study, some researchers took advantage of 
the TOE framework in combination with other frameworks. Some 
research applied the framework, nonetheless, without combining it with 
any additional frameworks. The following reasons support the case for 
employing the TOE in addition to the DOI. Firstly, the two frameworks 
are frequently and extensively used in studies on the adoption and 
implementation of IT or IS and other technological innovations. Secondly, 
in the organisational views that are included, the frameworks use 
organisations as their unit of analysis. Finally, they offer a powerful 
additional perspective for studying organisational innovation. In this 
regard, the researcher combined the two frameworks to develop a 
thorough lens for investigating the challenges to the implementation of 
IT governance. 


E Framework for information technology 
governance performance 


Weill and Ross (2004, p. 2) defined IT governance performance as the 
usefulness of IT governance in achieving four objectives: (1) Cost-effective 
use of IT; (2) effective use of IT for asset utilisation; (3) effective use of IT 
for growth; and (4) effective use of IT for business flexibility. This 
uncomplicated method of measuring performance was proposed in the 
study by Weill and Ross on /T Governance: How Top Performers Manage 
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IT Decision Rights for Superior Results, which may be the most cited book 
in the area of IT governance. The four objectives are given weight in 
accordance with their importance to the organisation. The definition has 
been used in previous studies for benchmarking purposes by both 
researchers and practitioners (Simonsson, Johnson & Ekstedt 2010, p. 10; 
Van Grembergen 2004, p. 52). 


E Integrated framework for this study 


Based on the previous sections that describe and discuss the constructs 
and the contexts that make up the entire research, below is acomprehensive 
pictorial representation of the constructs. The result is that organisations 
are motivated in different ways to establish IT governance. In addition, 
organisations encounter a variety of obstacles, problems and hurdles that 
must be overcome in order to successfully implement IT governance. These 
barriers can arise from a variety of sources, including the organisational 
context, the external environment and the IT governance context. As a 
result, organisations will be able to adopt IT governance through a variety 
of procedures, structures and relational mechanisms if the obstacles are 
recognised and overcome. The pictorial representation of the unified 
framework for the research is depicted in Figure 2.6. 


The alignment of the constructs that guide the study is provided by the 
suggested framework in Figure 2.6. All the elements of the research are 
represented in the framework for interrogation, as well as provide a guide 
on which data the analysis was based on, to answer the research questions. 
The study framework is offered in this section, together with a discussion 
of the literature review provided in the section that follows. 
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IT governance IT governance Inhibiting IT governance 
dri TT practice context. M fact performance 
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Source: Adapted from Mangundu (2017, p. 47). 
Key: IT, information technology. 


FIGURE 2.6: Proposed research framework. 
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E Discussion 


The investigation’s goals were to identify obstacles to IT governance 
implementation and then recommend solutions to assist organisations 
in implementing IT governance. The chapter on the literature review 
gave this study a thorough platform upon which to build. The research 
shows a convergence of opinion on the inhibitors to implementing IT 
governance, and most studies discuss these challenges as being primarily 
related to resistance to change, a lack of management support, a 
shortage of resources and insufficient stakeholder involvement. However, 
most of the research was carried out in the financial services industry 
and in developed economies. Few studies have been conducted 
discussing IT governance implementation in relation to, and specifically 
in, the setting of a developing country, according to Othman et al. (2011, 
p. 1773) and other sources. There is also little thought given to the 
challenges to IT governance in the context of health care, which might 
include a variety of difficulties because of its unique characteristics, 
such as the nature of the business and the predominance of health care 
practitioners in executive roles. There are also discrepancies, with some 
research showing managerial-oriented inhibitors of IT governance 
(Luftman et al. 1999, p. 11) and others showing people-oriented inhibitors 
of IT governance (ITGI 2014, p. 2). It is essential that the health care 
industry’s context is used to study the barriers to IT governance. 


Although the research offers some preliminary intuitions about the 
implementation challenges of IT governance, several divergent findings 
were found in the research on barriers to innovation adoption. Barriers are 
seen by some researchers as inhibitors, whereas others see inhibitors as 
the lack of facilitators (King & Teo 1996, p. 35, cited by Othman & Chan 
2013, p. 4416). According to several studies, inhibitors completely differ 
from enablers or facilitators (Cenfetelli 2004, p. 159). The South African 
health care industry needs research that makes use of several case studies 
to pinpoint the most significant and well-known set of obstacles to the 
implementation of IT governance. 


Previous academic studies on IT governance in South Africa have 
mostly focused on the implementation of IT governance, maturity levels 
of IT governance and the drivers for IT governance. Even while earlier 
study in South Africa has shown that IT governance implementation is 
still in its infancy, the causes of this lack of maturity have not been 
investigated (Chitambala 2010, p. 10; Gomes 2007, p. 68). Finding the 
causes of poor IT governance maturity levels, or IT governance inhibitors, 
has not received much attention. To the researcher’s knowledge, no 
study has been conducted to try and pinpoint specific elements that 
hinder IT governance in the South African health care industry. Thus, a 
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conclusion can be drawn that in-depth knowledge about the factors 
preventing the implementation of IT governance in South Africa is 
limited and must be researched with special attention to the health care 
industry. 


Importantly, the study of IT governance in health care may offer 
intriguing results and fresh perspectives because management, which 
oversees IT governance in health care sector organisations, is made up 
mostly of experts and professionals, particularly in the medical industry. 
In addition, neither the public nor private sectors are generally 
represented in the papers we analysed. As both health care sectors are 
integrated within the Department of Health, which oversees the 
South African health care industry, they are both included in this study. 
Although the commercial sector is return-motivated and the public 
sector is service-compelled, both sectors can benefit from the study’s 
conclusions. 


The study represents an initial attempt to justify and substantiate by 
building on from the literature review. Therefore, semi-structured interviews, 
document analysis and data collection through an online survey 
questionnaire were conducted in the private and public health care sectors 
in South Africa. The literature review findings in this chapter assisted in 
enlightening the initial responses to the research questions. Having 
discussed the relevance of the literature review in the succeeding section, 
a conclusion to the literature review chapter is given. 


E Conclusion 


The chapter discussed several points related to the adoption of IT 
governance and its challenges. As a result of how IT responds to strategic 
and environmental imperatives, it was shown that organisations are 
motivated to implement IT governance. Additionally, organisations 
implement IT governance in various ways depending on their requirements. 
The study is largely steered by the following proposition: IT governance is 
based on different and varying internal and external factors. Shaping the 
mix of implementation strategies is a multifaceted process that depends 
on multiple organisational factors, with the optimal mix varying from 
organisation to organisation, even when organisations are in the same line 
of business or even the same industry sector. In that regard, the drivers, 
inhibitors, implementation and performance of IT governance are 
dependent on organisations. 


Accordingly, the study endeavours to address the existing gap in the 
research by evaluating the inhibitors of IT governance in the health care 
context. The literature review chapter provided a justification for a study of 
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this nature. In summary, the chapter is crucial in providing an initial 
understanding of, and answers for, the research questions. Furthermore, 
the chapter provided theories that are used in IT innovation. The following 
chapter discusses the philosophical grounding and philosophical assumptions 
underpinning the study. 
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Research philosophical 
grounding and assumptions 


E introduction 


The research topic and the research questions stated in Chapter 1 
guided the review of pertinent literature in Chapter 2. The main ideas 
surrounding the research challenge were reviewed, along with pertinent 
prior research on IT governance, how those studies relate to one another 
and how those studies relate to this study. Furthermore, depending on 
the important terms in the study questions, prior studies were also 
critically examined and categorised. The literature research found that a 
combination of structures, procedures and relational mechanisms can 
be applied to initiate IT governance. Through a literature review, the 
research framework was created. The research further revealed that 
there are many issues that can make it difficult to establish IT governance; 
however, these are organisational factors that vary depending on the 
industry. 


Additionally, the study issues were examined in reference to past studies 
by other IT governance researchers in the literature review chapter (ch. 2). 
To broaden early literature findings and validate the responses to the study 
questions addressing IT governance in health care, this chapter explores 
the philosophical underpinnings and theoretical modelling. The research 
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problem and the research methods are connected, making it easier to 
produce a legitimate response to the research questions (Yin 2009, p. 63). 
This entails using data-gathering tools and procedures, philosophical 
research assumptions driving the methodology, and data inspection and 
presentation methodologies. The study’s methodology is heavily biased by 
the researcher’s philosophical presumptions (Coates 2021, p. 1; Creswell 
2021, p. 34). 


The chapter is structured as follows: The research approach is presented 
in the first section, which also includes philosophical presumptions. The 
study design and research techniques are then discussed in the following 
sections, together with the research philosophy, which serves as the 
foundation for the presumptions guiding the research. 


E Research philosophical worldviews 


Philosophical ideas endure while being hidden within the research; they 
provide direction for conducting research and should be recognised 
(Mertens 2010, p. 9). According to Creswell (2014, p. 35), worldviews are 
the scholar’s perspective on the world and the scope of their research. He 
contended that worldviews are informed by discipline orientation, the 
researcher’s or supervisor’s preference and prior research experience, 
which influences whether they choose to conduct their research using 
qualitative, quantitative or hybrid methodologies. 


Post-positivists adhere to sound quantitative research principles. 
They comprehend a deterministic philosophy in which causes influence 
outcomes. Studies by positivists demonstrate the necessity to discover 
and consider the causes that impact the results, for instance, those 
demonstrated in empirical experiments (Creswell 2014, p. 36). Social 
constructivists, in contrast, acknowledge that people seek to understand 
the world through unique interpretations of their engagement with it. In 
this instance, the researcher’s aim is to consider, to the greatest extent 
feasible, the research subjects’ perceptions of the status quo under 
study. The transformative worldview contends that the study’s focus is 
on politics and a plan for political change that will lead to social 
enslavement at every level on which it occurs (Mertens 2010, p. 11). One 
such worldview locus comes from pragmatists who, rather than focusing 
onthe research method, focus on the research topic, using a combination 
of ways to comprehend the phenomenon, such as qualitative and 
quantitative methods (Creswell 2014, p. 39; Tashakkori & Teddlie 2009, 
p. 284). Because of this, pragmatism is in favour of mixed-methods 
research (Creswell 2014, p. 39; Teddlie & Tashakkori 2010, p. 15). The 
relationship between these worldviews, designs and research 
methodologies is shown in Figure 3.1 (Creswell 2014, p. 35). 
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Source: Creswell (2014, p. 35). 
FIGURE 3.1: The interconnection of worldviews, designs and research methods. 


Philosophical presumptions in research 


Considering the four worldviews previously mentioned, all research, 
regardless of its subject matter, is tied to the core conventions of what 
constitutes a legitimate study and effective research methodologies. It is 
essential to identify and understand the research’s philosophical 
assumptions (Creswell 2011, p. 271). According to Creswell (2011), 
philosophical frameworks influence how well a design fits the research. 
Thus, philosophical principles serve as a framework for conducting research 
and must essentially be acknowledged (Creswell 2011, p. 271). The paradigms 
that guide the investigation are provided by these philosophical 
presuppositions or notions. Research paradigms are recognised as 
authoritative research traditions in a certain research community (Creswell 
2011, p. 275). The components of the paradigms include ontology, 
epistemology, methodology and methodologies (Scotland 2012, p. 9). 
Ontological presumptions concern what constitutes reality. Ontology, 
according to Creswell and Clark (2017, p. 38), is the study of existence and 
informs the theoretical perspective alongside epistemology. The researcher 
must have a confident viewpoint regarding how things are and how they 
function (Scotland 2012, p. 12), and they must be persuasive when describing 
how the paradigms are to be employed in presenting the research topic 
(Jokonya 2014, p. 6). These conceptions of reality (ontology) are contained 
in philosophical stances known as epistemology. 


Epistemology describes how a researcher comes to know what they 
know (Cohen, Manion & Morrison 2007, p. 7; Creswell & Clark 2017, p. 38). 


47 


Research philosophical grounding and assumptions 


The presumptions of epistemology concern the production, acquisition 
and dissemination of knowledge (Scotland 2012, p. 9). Different paradigms 
are based on various philosophical underpinnings and views of reality in 
study (Rehman & Alharthi 2016, p. 53). Individual methodological strategies 
drive each paradigm, and the methodology guides the approaches, data- 
gathering techniques, analysis and interpretation. Methodology governs 
how scholars go about learning what they think is known (Scotland 2012, 
p. 9). According to Crotty (1998, p. 3), a methodology is a strategic plan of 
action that justifies the selection of usage of specific approaches. Methods 
refer to certain processes and procedures for data collection and analysis. 
Through methodology and epistemology, these techniques can be traced 
back directly to an ontological viewpoint. It becomes impossible to engage 
in any research process without outlining the epistemological and 
ontological stances. Different viewpoints influence the research methods 
used to study-related phenomena (Grix 2018, p. 129; Scotland 2012, p. 9). 
Creswell and Clark (2017, p. 13) state the following: ‘The choice of method 
to adopt when studying a subject should be based on the researcher’s 
philosophical presuppositions, the research design, and the specific data 
collecting, analysis, and interpretation techniques used in the study’. 
The type of research topic or issue being addressed, the researchers’ 
individual experiences and the study’s target audiences are all taken into 
consideration when choosing a research approach. Additionally, Crotty 
(1998, p. 56) suggests that every research project should adhere to four 
stages. The research process is directed by these stages. As shown in 
Figure 3.2, the researcher’s design of the research methodology for this 
study was informed by Crotty’s arguments. 


Paradigm worldview 
(e.g. epistemology and ontology) 


Theoretical lenses (e.g. racial, social, 
science theories and systems approach) 


Methodological approach (e.g. qualitative, 
quantitative and mixed methods) 


Data collection methods 
(e.g. questionnaires, interviews, 


documents and instruments) 


Source: Crotty (1998, p. 56). 
FIGURE 3.2: Research study levels. 
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Critical paradigm 


Historical realism serves as the critical paradigm’s ontological viewpoint 
(Scotland 2012, p. 13). It highlights the certainty that exists inside 
communities and is created by common political, cultural, economic, ethnic 
and gender norms. It also highlights how societies are continually influenced 
from within. A society establishes social reality, which is then created and 
replicated. According to Cohen et al. (2007, p. 27), who contend that the 
social and positional influences of activists of that information determine 
reality, this is supported. However, because critical approaches are closely 
related to politics, they challenge conventional social institutions and take 
part in social action with the goal of emancipating the poor. They also 
investigate values and assumptions. Critical researchers typically begin 
with preconceived notions and have change as their end goal. Examining 
facts from a cultural, historical and political perspective is made easier by 
critical techniques. Cohen et al. (2007, p. 139) assert that the research 
produces change or reform, enhancing the participants’ existence. 


The critical paradigm has a weakness in that freedom is not immediately 
apparent. According to Scotland (2012, p. 13), there is not much proof that 
participants’ lives have changed; if they have, it may be negligible or non- 
existent. Critical researchers also stereotype individuals as members of a 
specific marginalised group, placing them in a category of homogeneous 
superimposed identities. The positivist paradigm is discussed in the section 
that follows. 


Positivist paradigm 


Positivism’s ontological stance is the conviction that things have a being 
separate from the knower (Cohen et al. 2007, p. 7; Myers 2019, p. 43; 
Scotland 2012, p. 10). As advanced by Myers (2019, p. 43), positivists 
typically hold that truth is objectively discernible and expressed through 
quantitative attributes, independent of the researcher and the research 
tools employed. The positivist paradigm places a strong focus on the fact 
that knowledge is unambiguously objective, that there is a distinct objective 
truth that exists outside of society and that knowledge is obtained through 
experiments. According to positivism, research should be focused on the 
truth as it exists, and its findings should be repeatable by other researchers. 
This entails putting theories to the test and making efforts to boost our 
understanding of the phenomenon. The positivist ontological perspective 
leads to a methodology that aims to explain relationships like cause and 
effect (Creswell 2009; Myers 2019, p. 43). The goal is to establish laws that 
serve as a foundation for generalisation and prediction (Scotland 2012, 
p. 11). As knowledge is speculative, hypotheses are neither confirmed nor 
disproved (Creswell & Clark 2017, p. 160). Descriptive and inferential 
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statistics are used in the analysis, allowing sample results to be extrapolated 
to larger populations and used for forecasting. 


The positivist technique, however, has drawbacks in that some variables 
can be concealed from the researcher and be exposed once their 
consequences are understood (Scotland 2012, p. 11). Additionally, results 
are frequently misinterpreted, and inferential statistics are frequently 
corrupted (Scotland 2012, p. 11). As a result, one cannot simply accept the 
results of inferential tests. The interpretivist paradigm is discussed in the 
section that follows. 


Interpretivist paradigm 


Interpretive scholarship primarily aims to comprehend phenomena through 
the meanings that individuals attach to them. For instance, understanding 
the information system’s context and the mechanisms by which it influences 
and is influenced by that context is the goal of interpretative meanings 
(Walsham 1995, p. 4, cited by Myers 2009, p. 2). Interpretive research, as 
described by Myers (2019, p. 45), concentrates on the entire richness of 
human sense-making as the circumstance demands, with no preconceived 
dependent and independent variables. The views of the participants and 
their own upbringing and experiences are used by interpretivists to 
determine reality (Myers 2019, p. 45). 


The importance of interpretive research in information systems research 
has grown (Riemer & Johnston 2019, p. 1; Vannoy & Salam 2010, p. 1). 
According to Myers (2019, p. 46), interpretive research helps IS researchers 
better understand human reasoning and achievement from a social and 
organisational perspective. The information system domain can be deeply 
understood through interpretive study. To put it another way, people’s 
interpretations of things help us to understand them. 


According to Reeves (2000, p. 23), interpretive goals influence how 
objects function by describing and interpreting the phenomena in terms 
of domain process, performance and innovation. Through qualitative 
methodologies like case studies and ethnography, the phenomenon is 
better understood (Daly et al. 2007, p. 45). To properly evaluate the 
data collected, Daly et al. (2007, p. 48) state that knowing the 
environment in which any sort of study is conducted is crucial. Instead 
of relying solely on statistics, the interpretivist paradigm and qualitative 
methodologies frequently seek experiences and insights from persons 
about their issues (Thanh & Thanh 2015, p. 24). Scholars are aware of the 
challenges in understanding intricate social and procedural phenomena 
in the field of information systems to quantifiable facts (Goldkuhl 2012, 
p. 1), which has led to the need for more exposed and knowledgeable 
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methods to investigate and analyse IS complexities. In complex 
environments, human performances, innovations and occurrences of 
domain processes are all addressed and interpreted by interpretive IS 
research. An understanding that is reached through the process of 
interpretation is the fundamental component of IS research knowledge 
(Goldkuhl 2012, p. 3). 


Researchers that base their arguments on a comparison to the positivist 
approach or the potential for combining them in IS research, however, have 
criticised the interpretivist approach. Because research typically yields 
highly contextualised research data, generalisations that are considered by 
policy-makers are missing. Furthermore, participants’ privacy can be 
respected because interpretive research processes are more well-known 
and flexible than positivist research methods. The pragmatist strategy is 
covered in the section that follows. 


Pragmatist paradigm 


Pragmatism blends several frameworks and techniques (Creswell 2021, 
p. 16). In conducting this type of research, there is meaningful synchrony 
between the various approaches and mindsets (Tashakkori & Teddlie 
2009, p. 293). Instead of focusing on methodologies, the researcher 
centres on the research problem and employs every available approach 
to comprehend the phenomena. Pragmatism is important in connecting 
many factors to the study problem by means of various slants to acquire 
information about the subject (Creswell 2021, p. 16; Teddlie & Tashakkori 
2010, p. 15). As academics make significant quantitative and qualitative 
assumptions in their research, pragmatism does not devote itself to any 
one philosophy (Creswell 2021, p. 15). According to Creswell, researchers 
are free to choose the methodologies, procedures and methods that 
best suit their needs and goals. As a result, pragmatism for a mixed- 
methods research unlocks a variety of methodologies, different data 
collection and analysis, as well as diverse worldviews and norms. 
According to many researchers, method triangulation is necessary to 
deepen our understanding of the phenomena we are studying 
(Venkatesh, Brown & Bala 2013, p. 1). For mixed-methods research, 
scholars have adopted pragmatism (Creswell 2021, p. 16). The discussion 
of pragmatism’s rationale is in the section below. 


E Justification of the pragmatist paradigm 


According to pragmatism, there is no one method that can fully grasp 
reality and advance knowledge (Creswell 2021, p. 16). A mix of subjective 
experiences and insights into their phenomenon (qualitative) and the 
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accuracy of the observed measures (quantitative) become essential for 
better understanding phenomena. A compound interpretation of mixed- 
methods research, which contends that compound paradigms can be used, 
however, be used explicitly (Agerfalk 2010, p. 253; Creswell 2021, p. 17), 
supports pragmatism. According to Tashakkori and Teddlie (2009, p. 294), 
pragmatism combines inductive and deductive ways to address the 
research topic and was deemed appropriate to serve as the foundation for 
a mixture of mixed-method approaches (Agerfalk 2013, p. 253). 


The idea that the difficulty of integrating methodologies stems from the 
many paradigms has, however, cast doubt on pragmatism. Despite the 
assertions, several academics have supported the viability of incorporating 
research methodologies from other paradigms (Tashakkori & Teddlie 2009, 
p. 315). The need to separate the many components while utilising their 
advantages has been stated by various academics to be sustainable 
(Tashakkori & Teddlie 2009, p. 314). 


The philosophical conventions that are most crucial to this study are 
those that are closely related to the main epistemology, which guides the 
investigation (Creswell 2021, p. 16). As a result, the philosophical 
presumptions drawn from a certain theory serve as the foundation for the 
research theoretical position that a researcher adopts. It is clear from the 
discussions in the aforementioned sections that the interpretive paradigm 
pursues to comprehend, the critical paradigm aims at emancipation and 
the positivist paradigm intends to generalise. The debate and conclusion 
on the examination of the barriers to IT governance in private and public 
health care in South Africa used the pragmatic philosophy, which is a 
synthesis of many paradigms (including the interpretive paradigm). 
Methodologies and processes for data collection, analysis and interpretation 
are further informed by the methodology. The research plan is covered in 
the section that follows. 


Research strategy 


The research strategy emerges from the conceptual foundations that guide 
the investigation. A research tactic is an investigational strategy that starts 
with philosophical presumptions and progresses to research design and 
data collection. The data-gathering techniques, such as ethnography, 
action research, grounded theory and case study research, are inspired by 
the research methodology. 
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E Discussion 


To support the philosophical justification for the study, this chapter explored 
various philosophical presuppositions and the underlying paradigms. To 
completely address the research questions, the case study research 
approach is selected under the pragmatist research paradigm, along with 
its justification. The study methodology used, the design, the tools used to 
gather data and the techniques used to collect and analyse that data are 
all covered in further detail in Chapter 4. 
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E introduction 


The philosophical foundation and theoretical modelling were covered in 
Chapter 3. It emphasised the theoretical underpinnings, the research 
strategy and the study design. In accordance with Yin (2011, p. 7), who 
claims that the research design connects the research problem, 
methodology, data collection procedure and data analysis to answer the 
research question in a valid manner, this chapter aims to build upon and 
extend the previous chapter and provide the pattern that the research 
follows to respond to research questions. 


The organisation of this chapter is as follows: The first section 
evaluates prior IT governance research methods in relation to the 
current research to catch a glimpse of pertinent scientific methods for 
addressing queries about the phenomenon under examination. The 
research method is covered in the second section after the research 
strategy. The importance of the problems and the level of concern 
shown by the literature evaluation guided the formulation of the study 
questions. 


The following is the primary research question: What are the practices 
and inhibitors to IT governance implementation in South African private 
and public health care sectors? 


How to cite: Mangundu, J 2023, ‘Materials and methods’, in /nformation technology governance practices 
and inhibitors in South African private and public health care, AVARSITY Books, Cape Town, pp. 55-88. 
https://doi.org/10.4102/aosis.2023.BK418.04 
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The following sub-questions, in addition to the main research problem, 
need to be addressed: 


1. What are the motivations behind the adoption of IT governance in South 
Africa’s private and public health care sectors? 

2. How is IT governance being implemented in South Africa’s private and 
public health care systems? 

3. How well is IT governance working in South Africa’s private and public 
health care systems? 


E Evaluation of earlier information 
technology governance research 
methodologies 


It was essential to analyse prior studies in the field of IT governance in 
order to be informed and to adhere to a pertinent scientific research 
approach in the study. According to the chapter on the literature review, 
CAQDAS, namely ATLAS.ti, was used to carry out the analysis. Based on 
the study topics and research techniques, prior studies were analysed. The 
research that has been analysed and used to guide the current investigation 
is shown. 


Bhattacharjya and Chang (2009, p. 82) conducted a study titled 
Adoption and Implementation of IT Governance: Cases from Australian 
Higher Education. They used a multiple case study research approach of 
two well-known institutions of higher education in Australia to address 
their research question. Their study only used qualitative data, which was 
gathered through semi-structured interviews and documents gathered 
from respondents and institution websites. The documents gathered 
served as secondary data sources and included general strategic plans, IT 
plans, disaster recovery plans, organisational charts, committee structures, 
and security rules and procedures. 


A critical literature analysis served as the foundation for a different study 
by Lee et al. (2008), titled A Casua/ Relationship between IT Governance 
Inhibitors and Its Success in Korean Enterprises. The status of IT governance 
practices in 96 top organisations in Korea was the subject of a survey that 
Lee et al. (2008, p. 5) conducted to gather data that were quantitatively 
analysed. 


Nfuka and Rusu (2010, p. 5) did a study on Tanzania as the case study for 
the Critical Success Factors for Effective IT Governance in the Public Sector 
Organisations in a Developing Country. They used a multiple case study 
methodology for their study, and five organisations provided information 
through interviews, with much of the data being qualitative in nature. 
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Barriers to Information Technology Governance Adoption: A Preliminary 
Empirical Investigation was the title of a study conducted by Othman 
et al. (2011, p. 9). The study used a multiple case study technique and 
included seven organisations from 63 different Malaysian industries. 
Semi-structured interviews were used to acquire the study’s only 
qualitative data. 


Another study, Hea/th Information Technology Governance: A Perspective 
on Investment Decision Process, was carried out by AbukKhousa and Al- 
Qirim (2012, p. 5). Their study used two hospitals - one from Egypt and 
another from the United Arab Emirates - in a qualitative multiple case 
study approach. The ClOs of the two hospitals were interviewed in semi- 
structured interviews, and secondary data sources included documents. 


A multiple case study research methodology was used in a study by 
Ismail, Alias and Rahman (2008, p. 5) on /T Governance Implementation 
in the Malaysian Ministry of Education. Semi-structured interviews and 
document gathering from four organisations were used in their 
qualitative data collection and analysis process. They gathered website 
content, organisational charts, strategic plans and circulars for their 
investigation. 


Barriers to Formal IT Governance Practice: Insight from a Qualitative 
Study, another study by Othman and Chan (2013, p. 4417), uses a multiple 
case study methodology that includes qualitative data collection and 
analysis from nine organisations made up of six publicly traded and three 
privately held businesses. Semi-structured interviews were used to gather 
primary data, and document collection was used to get secondary data. 
Annual reports, bulletins and official organisation websites were among 
the papers. 


E Discussion 


The facilitation of an in-depth appreciating, qualitative research 
methodology, in the form of a case study research approach, is seen to 
be essential to understanding the complex IS phenomenon, as evidenced 
by the analysis of past IT governance research methodologies. The 
analysis was considered and used as background information for this 
study’s research strategy. To reinforce and increase the credibility of the 
findings, the researcher in this study expands on the aforementioned 
research techniques by incorporating a quantitative research component. 
Therefore, it is believed that a mixed-methodologies case study research 
strategy is essential to comprehending the intricate IT governance 
phenomena. The research plan used is covered in the section that 
follows. 
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Research approach 


It is crucial for the researcher to define the term case study in this context 
because there are several definitions of what it is. Case study research is a 
diverse activity comprising a range of research procedures and techniques, 
coverage (from a single case study to carefully matched pairs up to multiple 
cases), levels of analysis (individuals, groups, organisations, organisational 
fields or social policies) and extents and degree of participation in 
organisational functioning (Hartley 2004, p. 332). 


It is imperative to make it clear that in this study, the case study technique 
is not being used as a research method but rather as a research strategy. It is 
not a methodological approach but rather a choice of the subjects to be 
investigated. This supports Hartley’s reiteration (2004, p. 324) that case study 
research’s theoretical direction and significance are in discrete cases rather 
than being sufficiently concluded by the research methodologies used. 


Analysis of earlier studies also served as the basis for the research 
approach in this study, which is heavily informed by the research question 
and its sub-questions. The decision regarding the organisations chosen for 
this study also considered additional restrictions and limits, such as the 
need for ethical approval and research restrictions. 


The kind of case study that will be undertaken must be decided. Case 
studies can be categorised as explanatory, exploratory, descriptive, solitary, 
holistic and numerous, according to Yin (2011, p. 49). This study is built 
around several case studies, which allows for an examination of the 
variations within and among the study organisations as well as the 
replication of findings among them. With the use of several data sources 
and a deeper understanding of the phenomenon, this method aids in the 
consideration of a contextual phenomenon. 


When thinking about the case study technique, a few things need to be 
considered in their proper context. Case studies, according to Yin (2009, 
p. 11), are pertinent when addressing the ‘how’ and ‘what’ issues, when the 
behaviour of people involved cannot be controlled and when there are no 
distinct lines separating phenomena from context. The major goal of this 
research is to identify the barriers to IT governance in health care. Without 
the background of commercial and public health care, the study’s 
conclusions could not be made. The problem statement is specifically 
related to and directed at these contexts, and it is these contexts that the 
research aims to address. 


Researchers in information systems have embraced empirical 
methods that emphasise human interpretations and meanings 
(Walsham 1995, p. 74). Case studies, in which the researcher analyses 
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the phenomenon over time, are frequently the inspiration for such 
empirical interpretive studies. This is consistent with the claim made by 
Mertens and Hesse-Biber (2012, p. 77) that qualitative research is a 
naturalistic, interpretive, multimethod science that uses interviews, 
observations and textual analysis to shed light on organisational 
practices and interpersonal relationships. Cavaye (1996, p. 227), who 
made the following arguments, provided support that a positivist or 
interpretive approach, a deductive or an inductive method, qualitative 
and quantitative techniques, and the investigation of one or several 
cases can all be used in case research. According to Cavaye (1996, 
p. 227), case studies can be conducted in different ways, including highly 
structured, positivist, deductive investigations of several cases; 
unstructured, interpretive, inductive investigations of a single case; and 
nearly anything in between these two extremes. 


Case study research is beneficial in emerging and understudied fields, 
particularly where the background and evolving features of the condition 
of affairs are important (Darke et al. 1998, p. 273). As case study research 
encompasses various understandings of the complicated IT governance 
in organisations, it was deemed to be suitable for this study. The case 
study, according to Yin (2003, p. 214), is a first-person investigation that 
looks at an existing phenomenon in its actual surroundings, particularly 
when the phenomenon and setting are not immediately evident. Case 
studies made it possible for the researcher to make multiple trips to the 
organisations to gather more data on the same phenomenon from various 
sources of evidence (Yin 2011, p. 13), ensuring the validity of the findings. 
Case study research is a well-respected empirical method that has been 
shown to be appropriate for IS in organisations (Oates 2005, p. 149; Oates, 
Griffiths & McLean 2022, p. 37; Yin 2009, p. 17). Case studies, according to 
Yin (2009, p. 2), help with ‘what’, ‘how’ and ‘why’ issues, which are 
pertinent to the ongoing research on IT governance in health care 
organisations. The focus of the discipline and this research is on 
information systems in organisations, and the spotlight has shifted from 
technical difficulties to organisational ones (Myers 2019, p. 46), making 
the case study technique clearly appropriate for information systems 
research. 


Arguments in support of case study research 


The representative studies examined in the previous section reveal that 
case studies or surveys are used in IT governance studies, and these studies 
are characterised using interview and questionnaire data-gathering 
techniques. To enable a thorough understanding of the topic of IT 
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governance, the literature reveals that it first emerged in the late 1990s 
(De Haes & Van Grembergen 2006b, p. 5), and it suggests that the case 
study research approach is the most suitable. Additionally, because the 
IT governance phenomenon exists in an organisational context, each 
organisation has a unique approach to the issue. Sturman (1999, p. 103, 
cited in Cohen et al. 2011, p. 289) asserts that because contexts are individual 
and unique, case studies must look at and take into consideration the 
actual, composite, dynamic and developing interaction of events and other 
factors in a particular instance. 


The peculiarities of the organisations under investigation and the dynamic 
nature of IT governance significantly support the use of exploratory research 
to lay a solid groundwork for the investigation and the development of the 
questions. This study uses organisations as the analytical unit CYin 2009, 
p. 32), and thus, a case study technique is acceptable and supported by the 
literature in that regard. This material emphasises how common case studies 
are in organisational studies and how they offer a full research strategy 
(Hartley 2004, p. 323). The normal need for case studies, according to Yin 
(2003, p. 2), increases because of the researchers’ desire to understand 
complicated phenomena and because using case studies enables them to 
maintain the eloquent individualities of reality and events, such as 
organisational and managerial practices. In this sense, this research, which 
examines IT governance as processes in 67 organisations at the managerial 
level, is ideally suited for a case study methodology. Stake (2000, p. 435) 
concurs with the aforementioned discussions and claims that case studies 
are now one of the prominent ways to engage in qualitative investigations. 


Case studies are particularly effective in providing ‘how’ and ‘why’ 
answers. The higher the case study’s chances of keeping on course, 
according to Yin (2009, p. 29, cited in Cohen et al. 2011, p. 56), the more 
explicit the topics it should address. As a result, the research questions 
posed in the previous section can be satisfactorily addressed using a case 
study approach. Finding the impact and providing foundational data for 
future IT governance research, particularly in the health care industry, are 
made possible by the utilisation of several case studies on the phenomenon 
of IT governance. Case studies can explain, describe, demonstrate and 
educate, to paraphrase Yin once more (Yin 2009, p. 19, cited in Cohen et al. 
2011, p. 60). 


Additionally, De Haes and Van Grembergen (2006, p. 5) advocate for 
case study methodology as being suitable for information systems research 
because academics lag behind practitioners in the business world in terms 
of understanding new IT innovations. 


The research technique was also impacted by the constraints and 
procedures for research ethical clearance. All participating organisations 
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must provide gatekeepers’ letters for any study. The university and the 
study organisations both gave their ethical clearance and approval. This 
requires approval from higher-ups and committees within the targeted 
organisations, which takes a lot of time. The committees’ annual meeting 
schedules for discussing research permission and support further prolonged 
the procedure. After receiving letters of acceptance from the study 
organisations, the researcher moved on to request university ethical 
clearance. The procedure can take months, and if final ethical approval is 
not obtained, there may be significant risks to the research or even a 
complete end to it. 


The provincial Department of Health cooperated with the researcher 
and indicated their willingness to participate in the study. Additionally, 
the provincial government advised the researcher to ask for assistance 
from the hospitals he would be visiting. The researcher communicated 
with many South African private health care organisations. However, 
only one of the private health care organisations offered their help. 
Because of the aforementioned factors, as well as the logistical and time 
restrictions, the researcher chose to use the numerous case study 
research approach. 


Case study knowledge generation 


Case studies have been shown to be useful in generating new information 
through theory development or theory testing (Yin 2011, p. 171). According 
to Myers (2019, p. 14), every single research project should be able to 
contribute to the body of knowledge within the field. Information 
technology governance is a common organisational and managerial 
phenomenon in real life, which case study research is appropriate for, 
allowing the development of useful knowledge (Yin 2011, p. 171). The 
knowledge gained through case studies can be used in other circumstances 
that are comparable. 


E Discussion on case study research 


Case study methodology has drawn criticism for the inability to generalise 
research findings, despite its legitimacy and appropriateness in this context. 
However, Yin (2009, p. 38) asserts that results from case studies add in the 
form of analytic generalisation rather than statistical generalisation, 
pointing out that case study research is not about statistical generalisation. 
According to Myers (2019, p. 93), the generalisability and validity of results 
are not increased by the number of cases. Results from case studies can be 
extrapolated to the theory but not to the population (Myers 2019, p. 90; Yin 
2011, p. 171). 
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Case organisations 


To better understand the IT governance phenomenon in both private 
and public health care organisations, the research organisations were 
specifically chosen (Creswell 2009). To select data collection units that 
would offer the most relevant and comprehensive range of opinions and 
information on the IT governance topic, organisations were purposefully 
sampled (Yin 2011, p. 32). Vigilant investigation was also conducted to 
lessen issues with misrepresentation and accessibility (Yin 2009, p. 32). 
The organisations were chosen based on the instances’ variety, applicability 
and accessibility. 


In South Africa, several provincial health departments and private 
health care organisations were initially contacted for participation in the 
study. Only one provincial Department of Health and one private health 
care organisation, however, supported the study and consented to 
participate in it. Several public hospitals in the chosen province were 
contacted, and they consented to take part in the study. Private hospitals 
encouraged and welcomed engagement within the private health 
care network. To provide reliable results, research organisations were 
chosen (Yin 2003, cited in Xue, Liang & Boulton 2008). The topic’s 
nature was taken into consideration as the choice was made. The 
selection of the organisations was based on their features because the 
focus is organisational-level phenomena. Size, organisational structures, 
geographic reach, and public or private ownership were among these 
traits. 


In accordance with the concerns, the research is based on one provincial 
Department of Health and government hospitals that are under the national 
department, representing the public health care sector. There are various 
levels of hospitals, including tertiary, regional, specialised and district 
hospitals. To ensure a legitimate and equitable representation of 
organisations in the study, the selection was based on location and 
government classification levels. Through the convenience of intracase and 
intercase analysis, the selection increases the usefulness of the results. 
Additionally, the choice of organisations within each of the several levels 
ensures variety among the internal environments of the hospitals. The 
usage of IT and IT governance is influenced by the hospitals’ size, location, 
range of services and patient traffic. Hospitals from different levels were 
predicted to produce a richer data collection than hospitals from the same 
level. Convenience sampling (Myers 2019, p. 44) was used within the 
stratum, which implies that the researcher collected data from hospitals 
that were nearby and willing to contribute to the study. The study’s private 
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Organisation description 


Private health care organisation 


Chapter 4 


Public health care organisation 


Characteristic 


Services 
Background 


Vision 


Mission 


Values 


Selection reasons 


Private health care group of 
hospitals 


Private health care services 


An investment holding 
company operates through 
its subsidiaries with the 
largest private hospital 
network in southern Africa 
and the United Kingdom 


Become a global, integrated 
health care organisation 


Develop and implement 
successful solutions to 
provide quality, affordable 
health care to the people of 
South Africa and globally 
by inspiring people, creating 
new health care horizons 
and delivering value to all 
stakeholders 

* Care 

e Truth 

* Dignity 

* Passion 


¢ Participation 


The organisation has different 
subsidiaries that are highly reliant 
on Information Systems in their 
day-to-day operations 


Source: Adapted from Mangundu (2017, p. 70). 


Provincial Department of Health 


Public health care services 


A public health care organisation 
operates through its hospitals across 
the entire province in South Africa 


Optimal health status for all persons 
in the province 


To develop a sustainable, 
co-ordinated, integrated and 
comprehensive health care system 
at all levels, based on the primary 
health care approach through the 
district health care system 


Trust built on truth, integrity and 
reconciliation 


Open communication, 
transparency and consultation 


Commitment to performance 


Courage to learn, change and 
innovate 


The provincial Department of 
Health is reliant on information 
systems in its daily operations in 
one of the biggest provinces in 
South Africa 


health care industry case study serves as its foundation. The study received 
additional support from private health care organisations and hospitals. 
Information on the examined organisations and their traits are provided in 


Table 4.1. 


E Research methods 


In information systems research, quantitative and qualitative research 
approaches are frequently used (Oates et al. 2022, p. 37). Despite the limits 
in understanding organisational social environments, quantitative methods 
have been suggested to be appropriate for gathering large samples of data. 


63 


Materials and methods 


Additionally, it has been argued that qualitative methodologies are 
appropriate for information systems research despite being time-consuming 
and unable to disguise large numbers of participants (Peng, Nunes & 
Annansingh 2011, p. 1). Combinations, also known as mixed methods, were 
created because of the limitations of separate approaches. The discussion 
of mixed-methods research is provided below. 


Mixed-methods research 


The ‘third methodological movement’ (Venkatesh, Brown & Bala 2013, 
p. 22) of mixed-methods research was founded around the year 2000 
(Lund 2012, p. 155). As a technique to supplement the shortcomings and 
constraints of both qualitative and quantitative study designs, mixed 
methods combine qualitative and quantitative tactics in a single study 
(Creswell 2014, p. 6). As mixed-methods research combines elements of 
both qualitative and quantitative slants, it resides between the continuum 
(Creswell 2014, p. 6). To understand research challenges, Creswell (2015, 
p. 2) describes mixed methods as a research strategy in which the 
investigator collects both quantitative and qualitative data, integrates it 
and then develops interpretations based on the strengths of both kinds 
of data. 


Mixed-methods justification 


In this study, the primary argument for using mixed methods is to 
complement qualitative data with quantitative data to tell a complete 
picture of the phenomenon being studied by integrating the individual 
strengths of each and to have a better knowledge of the research problem 
(Creswell 2014, p. 15). Combining approaches aims to capitalise on each 
approach’s advantages while minimising the drawbacks of each design 
(Creswell 2012, p. 6; Venkatesh et al. 2013, p. 22). Comparatively to using 
just one of the approaches alone, the combination of qualitative and 
quantitative designs offers comprehensive and improved insight into the 
study problem(s) under consideration (Creswell et al. 2011, p. 8; Creswell 
2012, p. 6; Frels & Onwuegbuzie 2013, p. 185). However, despite the benefits 
of the aforementioned hybrid approaches, they are time-consuming and 
labour-intensive (Creswell 2012, p. 6). 


The combination of the research’s approaches helped to better grasp 
the issue being looked at because the quantitative phase was able to 
complement the qualitative phase (Creswell et al. 2011, p.8). Creswell (2015, 
p. 14) asserts that the use of mixed methodologies is suitable when either 
quantitative or qualitative research is insufficient to fully comprehend the 
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issue at hand. The researchers were able to undertake an investigation with 
executive management to ensure that the study instrument, its measures 
and its interventions genuinely fit within the South African health care 
system by combining qualitative and quantitative research. Additionally, 
the qualitative phase allowed the researcher to link IT governance to the 
health care context and give more information about the health care 
environment to the quantitative research instrument. Additionally, by 
combining the methodologies, the researcher was able to gather data from 
all levels, including upper and lower management, which would have been 
challenging qualitatively. 


Finally, Weill and Ross (2004b, p. 57, cited in ISACA 2014, p. 19) claim 
that there are various archetypes or styles in which IT governance can 
be applied, including the business monarchy, IT monarchy, feudal, 
federal, duopoly and anarchy. The IT governance mechanisms (decision 
rights) in these archetypes vary greatly. The researcher’s understanding 
of the IT decision rights to be educated about the targeted study 
participants, particularly questionnaire responders, was made possible 
by combining the research methodologies. It subsequently became 
necessary for the researcher to carry out the qualitative phase through 
a review of the literature, semi-structured interviews and document 
analysis, which included committee compositions and organisational 
charts. The benefits of mixed-methods research are covered in the 
section that follows. 


Mixed-methods strengths in information systems 


Information system-related phenomena are fragmentary, inconclusive 
and context-based. From that standpoint, no one study technique can 
be adequate to focus on the depth and breadth of such intricate 
endeavours as IT governance. A mixed-methods approach has the 
advantage of offering a comprehensive and all-encompassing 
perspective of these difficult problems in organisations (Wooten et al. 
2014, p. 40). The methodologies were informed by the perspective of 
the research question, the research aims and the research setting 
(Tashakkori & Teddlie 2009, p. 285). 


Sequential exploratory mixed-methods design 


Three primary models can be used to classify mixed approaches (Creswell 
2014, p. 6). The convergent model is the first model, in which the researcher 
gathers and provides a detailed overview of the study problem by combining 
quantitative and qualitative data. According to Creswell (2014, p. 94), 
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the researcher can combine many types of data almost simultaneously 
before joining the data to comprehend the full results. Secondly, using 
explanatory sequential mixed methods, the researcher first conducts 
quantitative research, examines the findings and then expands on them by 
adding more depth to the findings with qualitative research (Creswell 2014, 
p. 94). Finally, in the exploratory sequential mixed-methods paradigm, the 
researcher starts with a qualitative research phase to learn about the 
participants’ perspectives (Creswell 2014, p. 95). After the data have been 
analysed, a second, quantitative phase is created using the information. 


The researcher chose to perform an exploratory sequential mixed-method 
study to supplement and advance existing IT governance study techniques, 
identify barriers to IT governance in the health care industry and provide 
best practices for IT governance. There are two stages to the research. 
Phase 1is primarily qualitative in nature and consists of data-gathering and 
analysis from semi-structured interviews as well as a critical study of the 
literature. Phase 2, which is largely quantitative and consists of the data- 
gathering and analysis for an online survey, is influenced by Phase 1. 


Phase 2 of this study used quantitative data-gathering and analysis based 
on findings from the qualitative study; as a result, Phase 2’s quantitative 
research questions, sampling and data collection were influenced by the 
qualitative study’s conclusions. The qualitative and quantitative strands 
were combined at the interface of data collection as part of the researcher’s 
sequential mixed-method strategy. The qualitative phase’s findings 
improved the design of the quantitative phase’s research tools, which in 
turn improved the identification of the most appropriate population for 
data collection. Figure 4.1, which was taken from Creswell (2015, p. 56), 
gives a brief overview of the path taken in this study. 


Use results to form 
variables, instruments 
and interventions 


Qualitative data 
collection and Qualitative results 
analysis 


Interpret how 
quantitative results 
provide new results 
and instruments 


Quantitative data 
collection and 
analysis 


Quantitative 
results 


Source: Creswell (2015, p. 56). 
FIGURE 4.1: Exploratory sequential design. 
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Reasons for exploratory sequential 
mixed-methods design 


The researcher was able to connect the study organisations to the research 
issue thanks to exploratory sequential mixed methodologies. The researcher 
learned more about the problems that were not previously anticipated 
thanks to face-to-face talks with participants who are participating in the 
daily IT governance tasks. Following that, these concerns were taken into 
consideration when creating the questionnaire. Additionally, the qualitative 
phase offered helpful direction for selecting questionnaire respondents for 
the study’s second phase. In Phase 1 of the study, email addresses and 
other contact information of potential questionnaire responders were 
gathered. The qualitative research is covered in the section that follows. 


E Qualitative research phase 


Despite the inherent variety within qualitative research, according to 
Denzin and Lincoln (2011, p. 3), it can be classified as a collection of 
interpretive, tangible practices that bring the world into focus. The world is 
changed by these methods. They transform reality into a collection of 
representations, including field notes, dialogues, interviews, recordings of 
photos and memos to self. Denzil and Lincoln further emphasised that by 
studying things in their natural environments, qualitative researchers try to 
understand or interpret events in terms of the meanings that people assign 
to them. 


Therefore, research addressing intricate, context-based social phenomena 
linked to organisations, such as IT governance, has shown that qualitative 
methodologies are most useful. With participant perceptions and insights 
as the starting point, qualitative research enables the exploration of 
phenomena from the inside out (Flick 2022, p. 42). Most academics agree 
that qualitative research makes it easier to conduct in-depth analysis on 
several research issues (Yin 2011, p. 12). Yin (2011, p. 12) claims that this type 
of research offers flexibility in doing research, which leads to its acceptance 
in various research domains. Qualitative research also gets around issues 
like the lack of big samples and demographics for surveys (Yin 2011, p. 89). 
To explore and comprehend human experiences through what individuals 
say, the phenomenon can be examined in actual contexts (Yin 2011, p. 4). 
According to Ormston et al. (2014, p. 3), qualitative research is focused on 
providing answers to ‘what’, ‘why’ and ‘how’ questions rather than the ‘how 
many’ type of research inquiries. As a result, hypotheses are frequently 
developed after data analysis and not at the beginning of the research. 
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To gain a basic grasp of the IT governance phenomenon through what 
participants said in their organisational contexts, qualitative research 
proved to be a suitable method (Myers 2019, p. 228). The researcher was 
able to better understand the difficulties surrounding IT governance 
through conversations and questions from the participants in IT 
governance (Myers 2019, p. 5). Through qualitative investigation of the 
subject, perspectives and interpretations from the participants’ 
perspectives were revealed; as a result, qualitative research focuses on 
the meaning participants make of their actual circumstances and is not 
just limited to the researcher’s understandings (Yin 2011, p. 143). One of 
the key goals of qualitative research is to ultimately generate concepts 
based on the meanings that participants shared (Yin 2011, p. 143). 
The procedures used in qualitative research are described in the next 
section (Phase 1). 


Qualitative research data collection 


Data-gathering took place from May 2015 to December 2015 and was 
strongly correlated with study questions and goals. Purely qualitative 
data were gathered, allowing for a thorough analysis of the phenomenon 
(Yin 2011, p. 71). According to Yin (2011, p. 71), qualitative data make it 
possible to understand a phenomenon through the experiences and 
statements of individuals. The fundamental benefit of qualitative research, 
according to Myers (2009, p. 32), is that the method allows for the 
preservation of participant data in its original form; the phenomenon is 
comprehended through what participants say in their social context. As a 
result, concepts can be formed by speaking with those involved in and 
impacted by the IT governance issue (Myers 2009, p. 32). There are 
various interpretations, and the researcher must be aware of this when 
conducting the analysis (Yin 2011, p. 234). This presents an opportunity. 
As a result, Phase 1’s data collection was exclusively qualitative. The 
processes used to collect the data are explained in the section that follows. 


Qualitative data collection methods 


Case studies recognise and agree to the existence of numerous variables 
acting in a particular case, and, therefore, to grasp the insinuations of 
such variables typically takes additional methods for data collection from 
numerous sources of evidence, according to Cohen et al. (2011, p. 289). 
The power of convergence from several data sources supports the 
outcomes of the investigation from the foundations of evidence, which 
comprises documentation, archival data, interviews, direct observations 
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and physical artefacts, as advised by Yin (2003, p. 85). According to these 
hypotheses, the literature research, semi-structured interviews and 
documentation from the organisations served as the primary methods for 
data-gathering in Phase 1. According to Myers (2009, p. 44), who asserts 
that although data can be acquired in a variety of methods, interviews are 
argued to be the best acceptable data collection approach. Thus, 
interviews were utilised as the primary data collection method. The 
sections that follow, including how they were conducted, describe 
triangulation and the sources of data used in the case organisations. 


Triangulation in the qualitative phase 


The researcher needed to carry out the qualitative study using a literature 
review, semi-structured interviews and document collection that included 
committee compositions and organisational charts (Creswell 2009, p. 106). 
As multiple approaches concentrate on various facets of the same problem 
under discussion, the triangulation enabled the researcher to comprehend 
the phenomenon richly and deeply (Mingers 2001, p. 244). In a single 
study, Yin (2011, p. 13) supports the use of several kinds of evidence for 
supplementary goals. 


O Complementary data sources 


Other sources of data in case studies include documents, archival 
records, interviews, direct observation, participant observation and 
physical artefacts, according to Yin (2009, p. 101, cited in Cohen et al. 
2011, p. 299). In accordance with Yin’s advice, the researcher gathered 
information from the sources listed in Table 4.2 and Table 4.3. The 
gathering of data from several sources improves the rigour and 
credibility of the data (Yin 2009, p. 2). Furthermore, the researcher 
was informed by the responsible, accountable, consulted informed 
(RACI) table suggested by ISACA to improve validity in terms of 
gathering data from pertinent study participants (2014). Responsible, 
Accountable, Consulted and Informed is referred to as RACI. According 
to ISACA (2014, p. 19), Table 4.2 outlines who should oversee IT 
governance inside organisations and who should be held accountable. 
Information regarding IT governance participants in organisations is 
included in Table 4.2. 


In addition, the researcher focused on the data sources, as 
stated in Table 4.3, in accordance with the suggestions made by Yin 
(2011, p. 13). 
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Health Organisation Interviewees Documentation Online survey 
care questionnaire 
sector respondents 
Private Private health  » IT governance e Overall strategic plan ¢ IT governance 
health care group officers + IT strategic plan officers 
care head office 5 cona x Fe 
Browder IT decision-makers, Organisational chart IT decision-makers 
e Business decision- Committee siructures e Business 
makers Na decision-makers 
e IT policies and procedures 
* Board members 
* Memos 
; a IT and IT 
e Website uploads ENICAN 
. Agendas Committee 
members 
* Governance, Risk 
and Compliance 
Committee 
members 
Private e Hospital CEOs e Overall strategic plan e Hospital CEOs 
hospitals e Finance managers œ IT strategic plan e Finance managers 
e Human resources e Organisational chart e Human resources 
Me Mag Sie) e Committee structures managers 
e Nursing managers e IT policies and procedures ° Nursing managers 
e Medical managers e Memos e Medical managers 
e Agendas 
Public Public health e CIO e Overall strategic plan and e IT decision-makers 
hospitals care provincial sT dacisionzmakers IT strategic plan « Busingss 
head office e Business decision- ° Organisational chart decision-makers 
makers e Committee structures e IT Committee 
e IT policies and procedures members 
e Website uploads 
e Memos 
e Agendas 
Public e Hospital CEOs e Overall strategic plan e Hospital CEOs 
hospitals 


e Finance managers 


e Human resources 
managers 


e Nursing managers 


e Medical managers 


Source: Adapted from Mangundu (2017, p. 79). 
Key: IT, information technology; CEO, chief executive officer; ClO, chief information officer. 


IT strategic plan 
Organisational chart 
Committee structures 

IT policies and procedures 
Memos 


Agendas 


E Interview target population 


Finance managers 


Human resources 
managers 


Nursing managers 


Medical managers 


To gather information, the researcher conducted semi-structured interviews 
with top management, IT and business decision-makers (ClOs, CFOs, 
hospital CEOs). The participants from these levels were the focus of the 
interviews because, as Table 4.3 illustrates, they are accountable, 
consultative, responsible and knowledgeable regarding developing and 
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sustaining IT governance (ISACA 2014, p. 6). The researcher has a contact 
person in each of the participating organisations who could give them 
access to these executives. The researcher identified the executives who 
were invited to the interview sessions and scheduled the data collecting 
session(s) in the organisations with the contact person. 


Sampling of interviewees 


According to the literature, the board and management are both responsible 
for IT governance (De Haes & Van Grembergen 2015, p. 11; Weill & Ross 
2004, p. 8). The defined population served as the study’s sample, or 
the primary participants, in accordance with the theories put forth in the 
literature. The sample was chosen to satisfy the research’s objectives 
because it included management-level IT and business process owners. 
ITGI (2012, p. 3) emphasised that the board of directors and executive 
management are responsible for IT governance and the effective use of an 
IT governance framework. Purposive sampling (Myers 2019, p. 44) was 
used, and the study concentrated on the senior executive teams of private 
health care organisations, senior management teams of private hospitals, 
senior management teams of the provincial Department of Health and 
senior management teams of provincial hospitals. This was in accordance 
with the literature from the fields of IT governance and research 
methodology. The participants who gave useful information on the IT 
governance phenomenon under inquiry were chosen using purposeful 
sampling. Snowballing was utilised to interview more people as references 
to more valuable informants were made (Myers 2019, p. 44). 


Sample size of interviewees 


What constitutes an appropriate number of interviews in qualitative 
research has been widely discussed (Baker & Edwards 2017, p. 1). Data 
saturation, according to Baker and Edwards (2017, p. 2), is what determines 
how many interviews are conducted. Depending on the methodological 
and epistemological viewpoints used, there may be 12-60 interviewees. 
Creswell (2015, p. 77) defines saturation as a stage in the data collection 
process where the researcher collects data from several participants, but 
the addition of data from additional people does not significantly advance 
the development of the codes or themes. The quantity of interviewers 
or their presence cannot be predicted; therefore, it is essential to have 
access to persons who are knowledgeable about the phenomenon being 
studied (Baker & Edwards 2017, p. 4). 


The number of interviews might be decided by considering the data 
saturation, the needs together with the theoretical foundations of the 
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study, demographics and the breadth and extent of the research questions. 
As a result, the sample size was considered as a function of the study’s 
saturation point. The researcher ceased collecting data when it reached 
data saturation. The researcher did not pre-determine the number of 
interviewees, as suggested by earlier researchers. This number was 
established throughout the data-gathering procedure, and 20 interviews 
were ultimately conducted. 


Semi-structured interviews 


Interviews were done to add to the initial list of IT governance drivers, 
inhibitors, structures, procedures and relational mechanisms from the 
literature review. Schostak (2006, p. 54, cited in Alshengeeti 2014, p. 40) 
asserts that an interview is a conversation between parties with the goal of 
generating in-depth knowledge about a certain topic and through which a 
phenomenon is interpreted through meanings given by interviewers. There 
are three types of interview data collection techniques: organised, semi- 
structured and unstructured. Rubin and Rubin (2011, p. 88) assert that 
semi-structured interviews are excellent for the depth of information that 
can be attained through them because they give the interviewer a chance 
to elicit more responses (Alshenqeeti 2014, p. 40). According to Myers 
(2009, p. 32), case study business research typically uses semi-structured 
interviews. In this study, semi-structured interviews with executives from 
the chosen health care organisations were conducted with the owners of 
both IT and business processes. These interviews provided the major data 
and document collection was used as a supplemental resource to gather 
more information. 


E The interview guide 


The major data-gathering tool was an interview schedule. The researcher 
began each section of the interview with a succinct overview and relevant 
examples to ensure that the interviewees understood IT governance. The 
research topic and its sub-questions served as the basis for each section of 
the interview guide. In addition, the interview questions were aligned with 
the framework’s components. 


Interview guide design 


To help develop the interview schedule, several industry-specific 
questionnaires were studied, as well as IT governance literature. To ease 
alignment and improve the research instrument’s internal validity, the 
research questions and conceptual framework were also used to influence 
the interview design. Questions on demographics, IT governance drivers, 
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IT governance inhibitors, IT governance implementation and IT governance 
performance made up the schedule’s five key sections. 


The demographics questions addressed topics pertaining to the 
foundation of the organisation, such as the characteristics of staff members, 
years of IT expertise, and the significance and use of IT in regular business 
operations. The study by Jasim (2010) on the importance of IT governance 
in boosting the competitiveness of for-profit private schools in Dubai 
served as the inspiration for the drivers of the IT governance elements. 
Additionally, the questions were developed in accordance with the research 
question and the literature review on IT governance. 


Several previous studies, including Enablers and Inhibitors of Business- 
IT Alignment (Luftman, Papp & Brier 1999), Barriers to Formal IT Governance 
Practice (Othman & Chan 2013) and Barriers to Information Technology 
Governance Adoption: A Preliminary Empirical Investigation, were reviewed 
to develop questions for investigation on the inhibitors of IT governance 
implementation (Othman et al. 2011). Themes from Phase 1 were merged 
with themes already present in the literature. Using the TOE, which the 
study modifies for the conceptual framework, the inhibitors of IT governance 
were then classified into the organisational context, IT governance context 
and environmental context. 


Weill and Ross’ IT governance performance questions were modified 
(2004, p. 2). Respondents evaluated their organisations in the IT governance 
performance question. The interview schedule was thoughtfully created, 
taking the health care environment into consideration. The component that 
assesses the effectiveness of IT governance initially modified Weill and 
Ross’ measures and variables (2004, p. 2). Adjustments were made in 
response to the results of significant tests of the effectiveness of IT 
governance in health care: 


1. Using IT to improve the delivery of clinical services. 

2. Successful application of IT to advance clinical research. 
3. The economical use of IT. 

4. Use of IT to improve administrative procedures effectively. 


Interview development matrix 


The researcher created the interview schedule in combination with the 
interview development matrix to maintain the research’s coherence and 
alignment. The research questions are broken down into interview questions 
through the interview development matrix. It guarantees that the main 
research problem and its subproblems are aligned with the interview 
questions. Additionally, it makes it easy to decide on suitable answers to 
each interview question. 
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Interview schedule validity 


Validity might come from the inside or the outside. Internal validity assures 
that the researcher is indeed looking at the phenomenon they claim to be. 
A precise sampling strategy was established and closely followed. 
Onwuegbuze and Leech (2007, p. 234) described internal validity as the 
certainty value, pertinency, consistency, objectivity, reliability and 
trustworthiness of interpretations and inferences within the inherent 
establishment or group. All the interview questions are closely tied to the 
research questions and objectives, and all subject facets were covered to 
help increase internal validity. The extent to which research conclusions are 
generalisable to a wider environment is known as external validity. 


Preparing for the interviews 


By creating interview questions and practising the interview, the interview 
preparation process was completed. The researcher was able to familiarise 
themselves with essential subjects, prompts and probes thanks to the 
interview preparation. Interview flow and emphasis on the research topics 
to be addressed are improved by interview preparation. The researcher 
chose important questions to ask and followed up with enquiries to learn 
more. The interview guide was pre-tested and sent to the candidates in 
advance so they could have a look and get ready for the interviews. To 
increase the chances of cooperation and, at the same time, address time 
constraints, the researcher informed the interviewees of the interview’s 
length in advance. 


Conducting the field research 


Principal informants who were informed about the concept of IT governance 
at the study organisations had to be sought out by the researcher. The 
CEOs were the organisations’ gatekeepers, who provided access to and 
support for the research. The CEOs were in a position of authority to open 
the doors and provide the research senior backing. The researcher gave 
the gatekeepers and participants more details about the significance and 
shared advantages of the research. Additionally, descriptions of the types 
of interview subjects and the documents that would be collected for 
examination were provided. 


Conducting interviews 


The researcher considered variables like the layout of the interview location 
before performing the interviews. These elements included background 
noise and additional potential interview process disruptions. Pre-testing 
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improved and ensured the recording equipment’s quality. The atmosphere 
should be conducive to hearing the interviews clearly, with little to no noise. 


Information technology and business decision-makers in the organisations 
under investigation participated in the qualitative interviews in person. All 
the interviews started off by thanking the subjects for taking part in the 
study. The researcher gave a brief outline of the subject under investigation 
and its possible advantages. To create a shared understanding and address 
the same topic in accordance with the research’s objectives and maintain 
content validity, the researcher next asked the interviewees what they 
understood about IT governance. To obtain consent to digitally record the 
conversations, the interviewees were also instructed on the ethical realms 
of anonymity and confidentiality. The participant information letters and 
consent forms utilised for the study were also provided to interview 
subjects. Before taking part in the research, all interview subjects were 
required to sign consent forms. 


An interview guide with questions that were directly drawn from and 
aligned with the research topics supported the interview progression. 
However, by closely following the interview protocol, the researcher was 
able to avoid dominating and directing the interview. In other cases, 
interviewees discussed topics that were scheduled to be covered later in 
the interview guide. In these situations, the researcher would merely use a 
follow-up method on already-stated problems. Interviews were conducted 
in boardrooms, conference rooms and occasionally in the offices of 
interview subjects. Noise and other disturbances barely affected most of 
the rooms. Most of the interviews lasted 45 min to an hour on average. 


The interviews were suitably spaced out, averaging two per day, two per 
week or two per month. This allowed the researcher to have adequate time 
between data collection sessions to conduct a preliminary analysis of the 
recorded interviews and field notes (Yin 2011, p. 166). The collection of 
qualitative data took place during a five-month period (from May to 
September 2015). 


Recording of interviews 


The interviews for the study were recorded using a digital voice recorder. 
Yin (2011, p. 171) asserts that recording aids in capturing the interviewee’s 
statements while they are being spoken. To ensure clear recordings of the 
interviews, the recorder was carefully positioned between the interviewer 
and the interviewees. The interviewees gave their consent for this to be 
done. As a backup plan, recordings were also made using an Android 
smartphone. Depending on whether the interview took place in a private 
health care organisation or a public health care organisation, the files from 
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each interview were given the proper names. The researcher then 
downloaded the interviews to her computer for backup and later 
transcription and analysis. 


Document collection 


Researchers have been warned not to rely too heavily on key informants as 
they can be biased (Yin 2011, p. 81). Secondary sources were gathered for 
analysis to provide research data provided by the study organisations, 
which complemented and validated the semi-structured interview data. As 
a result, following the interviews, documents were gathered. Strategic 
plans, strategic IS plans, committee structures, IT security policies and 
procedures, organisational charts, IT governance terminology and references, 
circulars and corporate websites are just a few examples of secondary data 
sources. 


Chain of evidence 


According to Yin (2009, p. 118), the researcher should put together a chain 
of evidence that includes two basic types of collection, namely, the definite 
data acquired, recorded and organised by entry, and the researcher’s 
continuing analysis of the data. Before doing data analysis, the researcher 
created a database of evidence in accordance with Yin’s hypothesis. 
Drawing a database of evidence, according to Yin (2009, p. 122), also 
provides the evidentiary chain of evidence that lends credibility, 
dependability and validity to the conclusions in addition to the evidence 
needed for the researcher to draw deductions. Building a database also 
has the benefit of making raw data accessible for independent review. 


The study utilised primary and secondary data. The primary sources of 
data were interviews. Plans and policies for IT, strategic plans, and terms 
and definitions for IT governance made up the secondary sources of data. 
The interviews aided in understanding the participants’ perspectives on 
the IT governance issue as well as their experiences, meanings and 
motivations. Using the ATLAS.ti software suite, the evidence database was 
created. The researcher then moved on to analyse the data to extract 
meanings and make sense of them, which is merely one stage of the 
research process. 


E Qualitative research validation 


Valid research is essential to its effectiveness; otherwise, it is worthless. 
Data validity in qualitative research can be attained by the individuals 
addressed, the scale of triangulation, the depth, richness and scope of the 
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data realised, and the objectivity or neutrality of the researcher (Winter 
2000, p. 9). The partiality of respondents, together with their moods, 
attitudes and opinions, all work together to introduce some bias into 
qualitative research (Cohen et al. 2011, p. 179). 


The researcher employed several techniques to verify the findings. 
These include participant verification, disclosure of the researcher’s bias 
and lengthier stays in research organisations. To establish reliability and 
credibility, all processes conducted during the research are explicitly 
documented for examination by other researchers. As proposed by Yin 
(2011, p. 41), a study is considered valid if the conclusions drawn from 
the data interpretations are accurate representations of the situation 
being researched. To allow for impartial assessment by other academics, 
the researcher documented every step of the process. Writing a proposal 
and getting it approved by a variety of parties, including university 
committees and committees of the organisations being examined, are 
the first steps in the process. According to Yin’s theories, all study 
processes are thoroughly discussed, together with the restrictions 
placed on the research and how the researcher attempted to overcome 
them. 


Additionally, conclusions from the research are formed using data 
from various viewpoints within the organisations under study. Multiple 
data sources were used in the study to strengthen the validity of the 
data collected in line with Yin (2011, p. 81). According to Cohen et al.’s 
(2011) assertions, this study attained research rigour through meticulous 
audit trails of the evidence, member verification, peer debriefing and 
respondent validation when coding or categorising the results. Using 
ATLAS.ti, all data was rationally organised into a database of evidence. 
The database can be reviewed by unaffiliated researchers to increase 
internal validity (Yin 2011, p. 82). The researcher then used ATLAS.ti, a 
widely used data analysis tool in the scientific community, to analyse 
research data. 


Generalisation 


The benefit of multiple case studies is that they can help make the findings 
more generalisable. The claim that case studies give analytical rather than 
statistical generalisation is made by Robson (2002, p. 183) and Yin (2009, 
p. 15). Case studies can help a researcher understand other similar events, 
phenomena or circumstances by contributing to the extension and 
generalisation of the theory (Cohen et al. 2011, p. 294; Myers 2019, p. 90). 
In this sense, choosing a province that offered health care services at all 
four levels - tertiary, regional, district and specialised - made it possible to 
generalise the research to a larger South African environment. Verschuren 
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(2003, p. 137) supports this claim by stating that the researcher can draw 
general conclusions from a limited number of case studies that are 
representative of complicated topics in general. Only after the researcher 
has determined the organisations that encompass the range of variability 
can external validity and generalisability be proven. 


The qualitative data’s capacity to be generalised depends on its 
theoretical contribution. Adhering to qualitative findings has limitations 
when attempting to generalise them to the entire community, as surveys 
do. In other words, it switches from statistical generalisation to analytical 
generalisation. According to Yin (2011, p. 79), qualitative research, which is 
not dependent on statistical methods like surveys, needs other strategies 
to generalise its findings. The results are extrapolated from a theory rather 
than from populations (Yin 2011, p. 45). In addition, Oates et al. (2022, 
p. 151) contend that analytical generalisations can lead to broader findings, 
whereas Myers (2009, p. 23) proposes that case study research can lead to 
four main generalisations, including notions, theory, consequences and rich 
insights or a combination of these. As a result, the researcher achieved 
both analytical generalisation and statistical generalisation through 
engaging in Phase 2 to increase the trustworthiness of the research results 
(quantitative phase). How the phases were incorporated into the study is 
shown in the following section. 


E Integration of phases 


There are three fundamental mixed-technique forms of data set integration, 
according to Creswell (2015, p. 6). The three approaches all use convergent 
design, which analyses quantitative and qualitative data separately to 
produce comparison findings. Explanatory sequence design is a different 
type of layout where qualitative information is used to aid in the explanation 
of quantitative outcomes. The third design is an exploratory sequential 
one, in which the problem is initially studied qualitatively before moving on 
to the quantitative phase to assess the study’s variables. According to 
Creswell (2014, p. 82), research data integration can take place in a variety 
of settings, including the study’s discussion section, the data-gathering 
phase, the data analysis phase and the presentation in tables and graphs. 


Exploratory mixed-methods research was used by the researcher 
(Creswell et al. 2011, p.10). The study implied that Phase 2 quantitative 
data collection and analysis would be based on findings from the qualitative 
study. Thus, qualitative findings help to improve the quantitative research 
tool and provide information to Phase 2 questionnaire respondents. At 
the interface for data-gathering, the two strands were combined. The 
quantitative phase was strengthened using the qualitative data (Creswell 
2015, p. 83). 
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Representation of integration in the 
mixed-methods study 


There are several ways to portray integration in a study, according to 
Creswell (2015, p. 84), who names them as data collection, data analysis, 
or the discussion and conclusion. In this regard, the researcher tabulated 
and presented the exploratory qualitative results in the opening column, 
the measures or variables resulting from the qualitative results in the 
subsequent column, and the process by which the measures and 
variables shaped new scales or instruments in the ultimate column. If the 
representation is constructed in this way, it is simple to grasp how the 
original qualitative phase built on to the quantitative phase, according 
to Creswell (2015, p. 85). 


Quantitative research phase 


In addition to other factors that have already been mentioned, the initial 
qualitative phase made it easier to comprehend the respondents’ 
terminology. The questionnaire items can be made clear and simple to 
comprehend with the help of the respondents’ language and terminology, 
which makes the collection of quantitative data more useful. Then, the 
qualitative stage’s findings, including the claims made in the literature, 
were confirmed and quantified during the quantitative phase, which was 
primarily deductive in character. Details on how the quantitative phase was 
conducted are provided in the sections below. 


Questionnaire development matrix 


The researcher created the questionnaire in collaboration with the 
questionnaire development matrix to maintain the research’s coherence 
and alignment. The research questions are divided up into sections by the 
questionnaire development matrix. It guarantees that the main study 
problem and its subproblems are in line with the questions on the 
questionnaire. Additionally, it makes it possible to choose suitable 
quantification scales for each questionnaire topic. Choosing the right 
statistical tests for data kinds, data measures and data types for answer 
options is also helpful. 


E The questionnaire 


A questionnaire is described in the literature as a tool for gathering and 
organising data regarding a certain area of interest. It is essential to consider 
factors for effective questionnaire design (McGuirk & O’Neill 2016, p. 4). 
The wording, order, duration and output of survey items are some examples. 
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According to the literature, a questionnaire should also clearly relate to the 
study objectives, and it is important to explain how the results will be 
interpreted and applied. To convey the study findings back to the 
respondents, the instrument also needs to tell them about the research’s 
purpose and ethical considerations. 


Considering the foregoing, the questionnaire was created during the 
first stage of the study process through a review of the literature and 
validation of the qualitative findings. The goal of the research was explained 
in an introductory section of the questionnaire, assuring respondents that 
all data were gathered in accordance with research ethics principles. 
Variables from Phase 1 of the research were identified, and listing helped 
identify key components of the study. To create the questionnaire, the 
variables were arranged in a purposeful progressive style that covered the 
conceptual framework. The questionnaire items were logically numbered 
and ordered, with similar items covering the same research objectives 
grouped together. Respondents were able to complete the questionnaire 
in its whole thanks to the logical order in which the questions were asked 
(Sarantakos 2017, p. 262; Bird 2009, p. 1310; McGuirk & O’Neill 2016, p. 11). 


Additionally, the questionnaire’s design was in line with how the data 
analysis was supposed to be done. In terms of the constructs and variables 
used in the form of the questions, the questionnaire’s design was influenced 
by the research aims. Bird (2009, p. 1310) asserted that open questions are 
simple to generate but complex to analyse, in contrast to closed questions, 
which are frequently utilised in quantitative studies. The survey was 
completely closed, making it simple to administer it online and do quick 
coding, analysis, comparison and quantification. Closing the questionnaire 
increased response completeness while preventing irrelevant responses 
(Sarantakos 2017, p. 255; Bird 2009, p. 1311). 


In this regard, the closed questions in the questionnaire measured the 
degrees of differences using nominal, ordinal, interval and ratio levels. A 
5-point Likert scale measure was mostly used in the survey questionnaire 
to provide a range of responses to specified questions or comments. To get 
around response option restrictions, the probable range of responses was 
defined, along with additional possibilities. The questionnaire was divided 
into Section A (demographic data), which included nominal, ordinal and 
scalar data types as well as discrete, continuous and dichotomous data 
types as relevant data measures. Additionally, only continuum data types - 
scalar as the data type - were used in Section B (IT governance drivers). 
Additionally, dichotomous data types and nominal data types characterised 
Section C (the establishment of IT governance). The continuum scalar data 
type made up Section D (IT governance inhibitors). Finally, the data type 
for Section E (IT governance performance) was continuum scalar. 
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Respondents had to mark the relevant option on a scale that ranged from 
strongly agree to strongly disagree for the drivers of IT governance 
objectives. Information technology governance performance objectives 
had grades from not important to very important as well as from not 
influential to extremely influential. Information technology governance 
implementation objectives ranged from not contemplating implementation 
to fully implemented. 


Questionnaire validity and reliability 


Validity might come from the inside or the outside. Internal validity assures 
that the researcher is indeed looking at the phenomenon they claim to be. 
The extent to which study findings are extrapolated to a wider context is 
referred to as external validity. External validity was supported by the data 
collection from many private and public hospitals located throughout the 
province of KwaZulu-Natal. A precise sampling strategy was established 
and closely followed. All the questions in the questionnaire and interview 
guide were directly related to the research questions and objectives, and 
all facets of the subject under examination were covered to help increase 
internal validity. The statistician also examined and approved the 
questionnaire’s content validity. The statistician went over the questionnaire 
more than five times to make sure that it could be easily understood by 
responders and that redundant questions had been removed. Construct 
validity testing was done during the process to make sure the instrument 
measured the things it was intended to assess. 


The researcher used a respondent-friendly design for the questionnaire 
in addition to taking into account the burden of the responses. The phrasing 
of the survey items was clear and unambiguous to allow respondents to 
easily and accurately comprehend the content of the questions. To increase 
the questionnaire’s value even further, it was pre-tested within the 
researcher’s organisation. Three senior lecturers and two IT administrators 
were given access to the questionnaire so they could review it, assess its 
quality and offer their opinions. In order to enhance the instrument, 
considerations were made and modifications were implemented. As a 
result, the questionnaire was developed iteratively until a consensus was 
reached on the final version. The data were subjected to Cronbach's alpha 
reliability test in order to evaluate the research instrument’s internal 
consistency. Additionally, the researcher scrupulously followed a sequential 
mixed-methods strategy and conducted the data-gathering and analysis in 
accordance with the criteria outlined in the data collection in an ethical 
manner. This increased the likelihood of getting the same answers and 
measuring what was intended by improving the reliability and validity of 
the questions. 
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Questionnaire administration 


A survey questionnaire can be delivered in several different methods, 
including physically and electronically (Creswell 2014, p. 76). These 
modalities of administration include self, email, telephone and face-to-face 
interactions. Each approach has pros and cons that vary depending on a 
number of variables. The way a questionnaire is distributed depends on the 
study’s applicability, the resources available, the sample size, the sorts of 
questions, the makeup of the population and the amount of time available 
(Bird 2009, p. 1312). The researcher conveniently reached the intended 
respondents by administering the questionnaire online in order to reach 
respondents from the two provinces. The final text of the questionnaire 
was transformed into an online questionnaire using SurveyMonkey with the 
approval of the statistician and supervisors. From survey design to making 
the questionnaire available for respondents to complete, SurveyMonkey 
offered robust and practical survey tools. Respondents whose email 
addresses had been gathered in Phase 1 of the study procedure were 
emailed links to the online questionnaire. The researcher was able to 
monitor progress during response collection as the respondents completed 
the questions thanks to SurveyMonkey tools’ quick alert messages. 


Phase 1 of the study involved making initial contact with the organisations 
and respondents, which helped to build much-needed rapport and provided 
inspiration for Phase 2’s online distribution. As a result, gatekeepers 
identified in Phase 1 greatly aided in obtaining higher questionnaire 
response rates in Phase 2. Gatekeepers followed up and sent out reminders 
on the researcher’s behalf, which led to admirable response rates during 
the quantitative data-gathering stage. The majority of the questionnaire 
respondents were members of the IT and IT governance committees, who 
occasionally received reminders to complete the online form during most 
committee meetings. Because of the huge response rates, quantitative 
data collection was successful. 


Questionnaire target population 


The board, strategic management level, executive management level and 
operational level were all included in the research population. Board 
members, CEOs, members of the IT and IT governance committees, and 
senior business and IT decision-makers were among the research 
respondents. Based on the qualitative findings, 150 respondents, including 
those who participated in the Phase 1 interviews, were the target population. 
A total of 121 completed replies were received for the study or an 80% 
response rate. Three months were spent collecting quantitative data 
(O1 June 2016 to 31 August 2016). The results of an analysis that followed 
were quantitative. 
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Sampling of questionnaire respondents 


As in Phase 1, the research employs a non-probability purposive sampling 
(Myers 2019, p. 44) technique inside the sample organisations. The only 
respondents who were expected to provide useful and accurate 
information to answer the research questions were those who were 
involved in IT and IT governance. The King III Report recommends that 
the board assign management the duty of putting IT governance 
frameworks into action. The questionnaire was delivered to management, 
who oversee putting IT governance into place in accordance with the 
recommendations made in this study. Although they came from the same 
population - management - the qualitative and quantitative samples had 
varying degrees of management. The population mentioned in the 
previous section about the questionnaire’s target population was the 
focus of the survey. 


The body of research advises using discretion when choosing instances 
that answer the study’s goals and queries. The researcher should also 
choose informants who are eager to communicate, educated about the 
topics being studied and representative of a variety of viewpoints. 
Accordingly, respondents were chosen based on their familiarity with and 
participation in IT governance within the research organisations. 


E Research ethics considerations 


Research ethics approval is one of the most important components of 
research. For every human subjects study, various precautions were taken 
to safeguard participants from damage. Prior to the study’s data collection, 
the ethical principles of informed permission, privacy, confidentiality and 
anonymity were upheld. The parts below include the conversation. 


University ethics committee approval 


The application and receipt of ethics clearance from the university marked 
the beginning of the ethical clearance procedure. Members of the University 
of KwaZulu-Natal’s Humanities and Social Sciences Research Ethics 
Committee reviewed the work. On 27 March 2015, the ethics approval was 
granted. 


Study organisations’ ethics approval 


The researcher then applied for and received ethics clearance from the 
appropriate authorities of the study organisations, namely, the 
Department of Health and the private health care group research 
committees, in addition to receiving ethical approval from the University 
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of KwaZulu-Natal’s (UKZN) Ethics Committee. The submission of the 
research proposal, university ethical approval and letters from the 
research leaders all helped to speed up the procedure (supervisors). 
The organisations’ ethical committees were ultimately satisfied, and 
approval was given. 


Gatekeepers’ approval 


The researcher then sought gatekeepers’ agreement for data collection 
after receiving the organisations’ ethical clearance letters. The organisations 
under study included a variety of departments and hospitals. Even if 
permission was given at the organisational level, the researcher still needed 
permission from the administrators of the participating hospitals and 
divisions. Different divisions and sub-units received submissions, and some 
of them verbally as well as in writing accepted the research. 


Voluntary participation and consent 


Finally, the researcher had to ask the respondents for their voluntary 
participation after obtaining permission at several levels, from the 
university to the divisions of the organisations. To comply with the 
requirements of informed consent (Myers 2019, p. 60), it was made clear 
to study participants that their participation was optional and that they 
might revoke their consent at any point during the investigation. The 
researcher had to get permission from the subjects before recording the 
interviews or having them fill out the questionnaire. Informed permission 
letters were signed by participants and the researcher in this process, 
with one copy being kept by the participant and the other by the 
researcher. 


Anonymity, privacy and confidentiality 


Cohen, Manion and Morrison (2017, p. 644) emphasised the need for 
participant characteristics to be kept confidential and stated that any 
infringements on this must have the consent of the participants. Cooper 
and Schindler (2001, p. 117) advised that confidentiality can be attained by 
acquiring signed agreements denoting non-disclosure of the research, 
containing access to data which ascertain respondents and requesting the 
consent of the respondents’ beforehand release of information about 
respondents. The organisations and participants were given aliases and 
pseudonyms in accordance with the request for anonymity made by the 
participating organisations. Additionally, significant measures were taken 
to maintain the privacy and confidentiality of all study data, such as 
password-protecting the interview files. 
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Risk and benefit 


The data were exclusively utilised for research purposes, and all essential 
security precautions were taken to keep it safe and prevent it from falling 
into the wrong hands. In case participants had questions about the research, 
the researcher gave their contact information as well as that of the research 
supervisors. The researcher also disclosed to the participants that there 
were no prizes or financial incentives associated with the process; rather, 
participation was entirely voluntary. 


Research data security 


The researcher and the service providers, especially the statistician and 
the transcriber, stored data, work products and research-related 
materials in a safe and secure location. The researcher and the service 
providers came to an agreement outlining the terms of the services, 
including the safe and secure keeping of the study materials. The 
researcher preserved all the research materials for as long as the UKZN 
required them to be kept for ethical audit procedures. Additionally, all 
electronic files comprising study-related paperwork and output were 
retained for as long as the institution needs them for ethical audit 
purposes, either on the researcher’s highly secured computer or in 
online or offline backup storage. After being kept safe in accordance 
with the aforementioned university standards, the research material 
will be disposed of in a way that prevents data from being recovered 
or ending up in the hands of uninvited parties, whether on purpose 
or accidentally. The researcher will then utilise specialised wiping 
applications to delete 97 electronic records. The procedure entails 
deleting from the storage discs and then erasing all computer drives as 
a second step. Supervisor and study organisation emails will be erased, 
and the deleted items folder will thereafter be cleared. The best 
technique to get rid of the information contained in portable media like 
a compact disc (CD) is to destroy the relevant media items, and therefore, 
CDs will be shattered. The researcher’s software would also ‘delete’ any 
data stored on a computer’s hard disc. If the text records do not 
include any sensitive information, they will be disposed of using standard 
waste disposal procedures, including recycling. The red confidential 
waste bags will be used to shred and discard sensitive paper records. 
Sensitive research material will be destroyed locally so that the researcher 
may be sure the records have been destroyed. 


In accordance with UKZN’s ethical guidelines and after consulting with 
research supervisors, the storage and disposal standards and procedures 
will be properly followed. 
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E Feedback on research results 


The standard of respect for people is the foundation for communicating 
study findings to participants. In exchange for the time and effort 
participants invest in the study, this is an ethical consideration. By presenting 
concise research reports to the study organisations, the researcher will 
give input in that regard. Publications will be forwarded to the private 
health care organisation and the Department of Health in copy form. If the 
researcher needs to physically present the research findings orally to host 
institutions, depending on the time limits of the study organisations, 
Microsoft PowerPoint presentations will be made upon request. As 
mentioned in the previous paragraph, copies of the research will also be 
distributed to the organisations. 


E Fieldwork challenges 


The processing of the ethical clearance presented the first difficulty. The 
procedure entailed the researcher requesting free participation in the 
research from all of the targeted organisations in writing and receiving 
their approval. This required the filing of pertinent paperwork, such as 
the study proposal, research tools, supervisor support letters and 
documentation of enrolment at the university. The researcher had to 
submit to the university for final research ethics clearance after receiving 
approval from the targeted organisations. However, the procedure for 
the ethics applications ultimately involved the back-and-forth sending 
of papers. Data collection was delayed by more than three months 
because of errors that were found on the initial ethical clearance letters 
that had to be corrected. The letter of ethical clearance was finally 
published. 


The next problem was contacting participants to set up interview 
times after the final ethical clearance letter was issued. It was difficult to 
schedule interviews with the intended participants as they were 
managers with obligations, making it difficult to complete the 
questionnaire. Most of the time, the intended audience members were 
either attending significant meetings or had full schedules. However, it 
took a lot of persistent follow-up on the part of the researcher to 
eventually obtain them for the questionnaire and interviews. Some 
interviewees were reticent during the interviews, which caused them to 
give brief answers to the questions. The researcher had to reassure the 
participants that the research was just being done for academic 
objectives and that the participants would not be harmed in any way to 
ease the talks and allow for further exploration. 
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E Conclusion 


Following the established research approach, Chapter 4 went over the 
primary research topic and the sub-questions that needed to be answered. 
For this study, methodologies from earlier studies on IT governance were 
assessed. Methodological triangulation was used to acquire an intense 
insight of the phenomenon under study and to improve and expand upon 
earlier IT governance studies. Finally, a thorough discussion of ethical 
domain concerns was conducted. These topics included ethics clearance, 
gatekeepers’ consent, voluntary participation, privacy and confidentiality, 
protection of research data and reporting of findings. The coding of 
qualitative data is covered in the following chapter. 
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Presentation, interpretation 
and analysis of qualitative 
data 


E introduction 


The most crucial step in addressing the research questions is to extract 
meaning and make sense of the data through data analysis after 
the research data have been gathered. According to Leedy and Ormond 
(2005, p. 4), who were quoted by Motloutsi (2010, p. 53), data are of little 
or no use only by themselves, and data should be relevant to the research 
question. Extraction of meaning is crucial and necessitates the application 
of pertinent scientific methodologies to adequately address the research 
concerns. The backdrop of the study is given in Chapter 1, along with the 
statement of the research problem that justified the need for the study. 
Additionally, the necessary study goals and the research questions were 
offered. 


The literature study in Chapter 2 showed how important IT governance 
has become to business. According to the literature, IT governance can be 
achieved through a combination of relational mechanisms, structures and 
processes. The literature also showed that a number of obstacles prevent 
the implementation of IT governance. Additionally, Chapter 2 provides the 
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theoretical foundation that guides the examination of the research issues. 
The various theories of innovation are explored, and those that offer a 
comprehensive lens through which to approach the research issues are 
chosen. To frame the examination of the research topics, the researcher 
combined the TOE and the DOI theories. 


The philosophical foundation and theoretical modelling are covered in 
Chapter 3. To provide a meaningful response to the research questions, 
philosophical assumptions provide a relationship between the research 
topic and the research methodology. This entails the philosophical 
presumptions underlying the study’s methodology, methods for gathering 
data and methods for data processing and presentation. 


The research was conducted using a sequential mixed-methods 
methodology, which is described in Chapter 4. Through chosen private and 
public health care organisations in South Africa, an exploratory study is 
being conducted. Semi-structured interviews with business and IT decision- 
makers were used to gather primary data, which were supplemented by 
secondary data from the document-collecting in Phase 1 process. Phase 2 
involved collecting additional data via an online survey form. Using the 
ATLAS.ti programme, qualitative data were thematically analysed. 
Following the development of codes and code categorisations, qualitative 
data analysis is conducted with the primary goal of identifying the barriers 
to IT governance implementation in organisations, along with other 
research goals, all within the context of the research conceptual framework 
described in Chapter 3 of this book. 


In accordance with the study framework established in Chapter 3, 
qualitative data coding, data analysis and qualitative outcomes are 
provided in this chapter. The conclusions are supported by 
information gathered from the Department of Health and commercial 
health care organisation business and IT decision-makers. Each section 
of the study framework is followed by a variety of conclusions that are 
announced. 


E Deductive and inductive analysis 


While Blaikie (2007, p. 79) contends that there is no such thing as pure 
deduction and that inductive researchers do not produce or interpret 
data with a blank mind, their data analysis is influenced by deductive 
assumptions deriving from earlier research in the topic. Given that data 
were gathered through semi-structured interviews, the researcher used 
both deductive and inductive approaches to data analysis. Using ATLAS. 
ti as the computer-assisted software tool, concepts, ideas and themes 
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emerged from the data, while other themes supported themselves in the 
literature review. 


Data analysis procedures 


The researcher started by inserting all the research data into ATLAS.ti to 
create a hermeneutic unit. Thematic analysis was used to analyse the 
transcriptions of the interviews once they had been entered into the 
database. The database was filled with all the study organisations’ IT 
decision-related documents. The steps taken by the researcher to derive 
meaning from the data gathered are described in depth in the sections that 
follow. 


Reasons for using ATLAS.ti 


NVivo, ATLAS.ti, SPSS, MAXqda, NUD*IST and Ethnograph are a few 
examples of computer-assisted software applications that can process 
data ready for analysis. The researcher must first upload the transcripts 
into the computer before using the software. Single and many data sets 
are grouped, located, organised and searched by the software, which 
then returns the results prepared for analysis and display. As a result, 
the researcher conducted systematic, transparent and cohesive data 
analysis using ATLAS.ti. The user-friendly software package ATLAS.ti 
allowed codes to be applied consistently, excluding no data. 


O Interview coding 


According to Gibbs (2018, p. 53) and Flick (2018, p. 482), one of the key 
components of qualitative research is coding. A code is a term or label 
given to a text that represents an idea or piece of information. Coding is 
the process of turning survey replies and respondent data into accurate 
classifications for analytical purposes. 


The researcher began by generating key codes from the research 
questions in this regard. The study questions served as the prototype 
codes, master codes and those deriving from them that were incorporated 
into the interview schedule. Secondary codes were then used to record 
different ways that respondents expressed themselves about the subjects 
of each interview question. Identification of related information and 
retrieval of objects with the same codes were made easier and more 
efficient by coding. A list of codes was developed, focused on contexts, 
practices and meanings and is stored together with what the codes mean, 
according to Gibbs (2018, p. 53). 
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As advised by Miles, Huberman and Saldaña (2018, p. 10), the researcher 
used an iterative coding procedure, beginning the procedure as soon as 
feasible following the initial round of data-gathering. According to Miles 
et al. (2018, p. 10), coding should include a restatement and reiteration 
process, where some codes used in the initial phases of coding might be 
altered, allowing the researcher to work on the research data more than 
once to facilitate consistency and exhaustion of codes. Coding was used to 
find patterns and frequencies in the research data. Data from interviews 
can be analysed using thematic analysis. This entails locating and analysing 
data topics (Braun & Clarke 2012, p. 58). All the interview scripts were 
entered into ATLAS.ti, the programme used in the study to analyse 
qualitative data, after being transcribed. The researcher was able to go 
over each interview transcript using ATLAS.ti and code new ideas as well 
as recurring patterns. 


CO Open coding procedures 


As part of the formatting procedure, the researcher divided the interviews 
into distinct data chunks based on the interview questions. This is 
corroborated by Crabtree and Miller (2022, p. 54), who state that organising 
the data for later analysis and interpretation can be accomplished by 
considering the research questions as discrete codes at the beginning of 
the data analysis. The research questions’ codes served as the basis for the 
qualitative analysis. 


After deciding on the study questions as codes, an encoding procedure 
was started, as discussed by Boyatzis (1998, p. 4). Boyatzis views the 
encoding process as an evolution of data organisation for the development 
of themes from codes. Themes provide the organisation of the possible 
observations that describe and interpret the qualities of the phenomenon 
in this context (i.e. codes). The researcher used line-by-line analysis of the 
interview transcripts to find these themes, providing concise word 
summaries for each pertinent line of data and precisely summarising the 
meaning of the text segment, also known as labels (Cohen, Manion & 
Morrison 2017, p. 652). The words from the coded sentences were 
occasionally employed by the researcher when creating the codes. 
Following the completion of the interviews’ coding, the code manager’s list 
of all codes generated immediately emerged. 


The researcher next engaged in an iterative process of constant 
comparison to reduce the large list of codes into a smaller, more manageable 
number of codes to ensure that each participant’s viewpoint was coded. 
According to Cohen et al. (2017, p. 653), coding should not be viewed as a 
one-time task. Cohen et al. (2017) claim that to achieve consistency and 
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code coverage, the researcher must go back and forth multiple times while 
reading and rereading, assigning and reassigning codes, placing and 
replacing codes, and refining codes. 


After the initial coding was finished, the open codes needed to be 
organised into code families using overarching themes or categories. The 
categories made sure that all notions were more abstract and could be 
grouped consistently. A variety of themes arose, offering a reflection on 
the study’s goal. Additionally, the themes were thorough and sensitive to 
the information in the data. These comprised common themes that the 
researcher anticipated, unexpected themes that shocked the researcher, 
difficult to categorise themes that contained thoughts that did not fit into 
one theme, and finally, major and sub-themes that represented the key 
ideas. 


The researcher looked at the concepts that comprised the themes and 
sub-themes, paying close attention to how they interacted with one 
another. To establish evidence of connections between the overarching 
themes, it was necessary to fit quotes that were originally difficult to 
categorise into anumber of topics. The researcher followed the procedure 
as described on the first set of interview transcripts before doing it again 
on the other transcripts. As the coding process continued, some new 
themes appeared. The researcher went back to the earlier interview 
transcripts and compared the new themes to the old ones to see if any 
ideas needed to be adjusted. This process of comparison is ongoing. 
Using the interview data as the starting point, the coding procedure 
produced a classification tree that moved from the specific to the general, 
moving from the codes to the sub-themes to the themes that led to 
theoretical generalisations. 


The main characteristics of the situation under study were summarised 
by the researcher. Key ideas and challenges raised by the data were 
identified in the summary (Cohen et al. 2017, p. 658). Additionally, 
the researcher worked on the report. The story was built during this 
process using the themes, sub-themes and codes. It also included 
defining the concepts, providing quotes from the interviewees to bolster 
the ideas and talking about how the sub-themes and the main themes 
interacted. 


Document analysis 


The ATLAS.ti programme received the documents to be analysed. 
The documents that were gathered were coded for content. The researcher 
first coded the data, then categorised the coded remarks into different 
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groups to thematically organise the data. Analysing documents followed a 
similar procedure to interview analysis. The categories of topics found in 
the interview analysis were used to organise the documents 104 that were 
gathered from the organisations. Themes acknowledged in the interviews 
were backed by statements and pictures, which were classified. Other 
materials that had no bearing on the study’s findings were not coded. The 
records served as support for the interviews, and new insights also came 
from them. 


O Summary of coding procedures 


In conclusion, the researcher used a methodical process that included four 
consecutive steps. The research questions were used to create primary 
codes in Stage 1. The second stage entailed listing each code that originated 
from the coded data under a certain primary code. The researcher then 
reviewed the list of codes generated in Stage 2 and categorised the 
difficulties in Stage 3. In Stage 4, the researcher analysed the messages 
from the groups from Stage 3 and made comments on them. 


O Coding reliability and validity 


Inter-coding made it easier to trust content analysis, which improved 
validity. According to Hartley’s (2004, p. 330) advice, an essential 
component of increasing validity was reviewing the findings with study 
participants. Additionally, data analysis was carried out using references 
from the literature to ensure that the research findings were consistent 
with those of other studies. The study’s results are discussed in the 
sections that follow. 


E Qualitative findings 


The systematic process used for data coding and data analysis was 
described in the parts prior to this one. The parts below contain the findings 
from the qualitative data analysis, which revolve on the Chapter 1 research 
topics. The research topics focused on the drivers of IT governance, the 
implementation of IT governance, the barriers to IT governance 
implementation and, finally, the performance of IT governance in both 
private and public health care sectors. 


E information technology and information 
technology governance in health care sector 


The researcher includes biographical details, covering IT and its significance 
to the organisations, to helo readers understand how IT is used in the 
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organisations under study. The private health care group’s affiliated facilities 
and corporate headquarters provided the data collection. Additionally, 
information was gathered from the department’s affiliated hospitals and 
the provincial head office. The designations of the interviewees, all of whom 
had extensive knowledge and expertise in the field of IT and IT governance, 
comprised IT managers, IT governance officers, chief information officers 
and members of the Governance Risk and Compliance team. 


The majority of participants emphasised how IT has developed into a 
strategic instrument for managing daily operations in the health care 
industry. The strategic importance of IT to health care business and 
operations is emphasised in the statements made by interviewees. 


Information technology became a hot topic of discussion as the 
importance of IT in organisations became clear. Information technology 
challenges and how IT may enhance corporate operations and meet 
objectives are frequently brought up in meetings. The reasons for IT 
governance gave rise to attempts to utilise IT and its advantages. The 
motivators are the widely acknowledged explanations for the support of 
IT governance projects. Understanding the motivations behind IT 
governance deployment was important for achieving the goal of giving 
the company an IT edge. The following section discusses these so-called 
push factors. 


Information technology governance driver results 


The field research’s drivers are considered in this section, which also 
declares why commercial and public health care organisations should 
apply IT governance. Most of the interviewees emphasised that the 
deployment of IT governance was driven by the need for better IT 
decision-making that was in line with business objectives. Information 
technology now serves business goals and requirements as IT decisions 
are no longer made in isolation but in collaboration with business 
decisions. Interviewees also mentioned that regulatory compliance forced 
them to think about IT governance. The policies of the government and 
other regulatory authorities have an impact on the environment in which 
businesses operate. These outside variables prompted organisations to 
think about implementing IT governance. One of the crucial laws 
promoting the implementation of IT governance was named as the 
Protection of Personal Information Act 4 of 2013 (PoPIA). The rising 
reliance of business on IT, they continued, made it imperative to govern IT 
in order to achieve the intended business benefits. The quotations from 
the interviewees that are included below support the aforementioned 
opinions on the subject of the factors that influence IT governance in 
organisations. 
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According to a report by an IT governance officer, there are several factors 
that influence IT governance: 


‘| think it’s to provide the element of a number of things, there is legislation 
coming through like PoPIA to enable deliver value through IT to the business, 
deliver business value through IT, obviously manage some of the risks that we 
have, manage some of the IT risks, and also as a framework IT governance is also 
helps ensure that you plan for it as a business strategy so it gives that framework 
that is essential. (IP1, participant, n.d.) 


The IT risk manager concurred as well: 


‘We didn’t have a governance framework that was overseeing everything that 
was happening in IT because you invest so much in IT but you don’t necessarily 
derive the benefit from it, and you constantly see IT projects, you constantly 
see business needs not being aligned to IT strategy, and they have to be some 
mechanisms where we can track, we can audit trail, and security as well. Because 
we came from a company where we purchased various companies, there were 
therefore widely dispersed methods and varied IT systems. (IP2, participant, n.d.) 


The IT risk manager emphasised further that: 


‘The recommendation was also made by the board because we report our risks 
to the board’s audit and risk committees. As a result, the board wasn’t happy 
with the level of risk we were carrying from an IT perspective and ordered that 
some of the burden of ensuring IT risks be placed on audit. Accordingly, the 
board audit committee gave the order that we begin looking at a framework to 
put into place.’ (IP2, participant, n.d.) 


According to the compliance officer: 


‘First and foremost, King III compliance was a driving force behind the need for 
IT governance because it is a condition for JSE listing and King III places a lot 
of stress on it. They then chose COBIT, the most well-known standard to align 
to, as their prior CIO determined that we required a framework to base our IT 
governance on. After that, COBIT’s design was started approximately three or 
two years ago, and we began implementing it last year. To answer your question, 
| would say that it is first and foremost a matter of legislation, but it is also 
important to put in place a framework that will add value to the company. In 
other words, the goal is not to accomplish everything, but rather to streamline 
the framework for the organisation.’ (IP3, participant, n.d.) 


The second IT governance officer said: 


‘We always approach audits from a risk-based perspective, mitigating risk 
organically even when we don’t provide a particular or mandated name for a 
framework. We’ve been doing that for a long time. We wanted to be able to 
discuss governance in a way that individuals outside the organisation could 
comprehend, in my opinion.’ (IP4, participant, n.d.) 


Member 1 of the IT governance team said: 
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‘| believe the only justification for doing so is to minimize risk to reduce any 
exposure or potential harm. In my opinion, businesses simply need to embrace 
this and understand the necessity of governance regulations and enforcements.’ 
CIP5, participant, n.d.) 


Chapter 5 


The results show a pattern in what motivates health care organisations 
to adopt IT governance. The findings showed that several factors 
influence organisations’ decision to establish IT governance, including IT 
risk management, statutory requirements and IT value delivery. Most 
interviewees said that IT governance helps organisations accomplish 
their intended business goals and objectives, from IT investments to 
better business and IT alignment. They also referred to how IT has 
developed into a strategic business enabler in the business and health 
care environments. Because businesses rely so much on IT, good 
governance is essential. Additionally, most participants agreed that the 
realisation of the advantages of IT governance has prompted executive 
management and boards to put it into practice for better IT decision- 
making and IT reporting. 


The study also reveals that both internal and external pressures have an 
impact on how IT governance is implemented by organisations. There is 
consensus that the drivers are the outcome of trigger events and pain 
spots, as shown by a comparison of the literature and research data. The 
literature divides the drivers into internal and external components, and 
the current investigation has confirmed this division. However, the study 
shows that organisations are mostly driven to implement IT governance by 
internal forces. However, it appears that meeting legislative requirements is 
the only external commitment that must be fulfilled; all other motivations 
for IT governance come from within the organisations. 


Moreover, organisations are compelled to realise economic gains from 
such expenditures because of the high capital requirements of IT systems. 
The best strategy to get the intended business value out of IT investments 
has been identified as IT governance. Information technology now satisfies 
business demands as IT decisions are no longer made independently from 
business decisions. For routine business operations, organisations are 
becoming more and more dependent on IT systems. The systems completely 
cover the essential business operations of the organisations; thus, any 
interruption in the operation of the IT systems results in a significant loss of 
revenue for the company. As a result, the organisations are left with no 
choice but to manage the IT systems. 


Information technology governance has primarily been viewed as an 
administrative hassle in recent years. There was a lack of understanding of 
the justifications for its consideration. In this perspective, organisations in 
the past saw IT governance as a resource-intensive activity with few actual, 
measurable business benefits. The benefits of IT governance have, however, 
been more apparent and more understood during the past few years. 
Business and IT decision-makers are now seriously considering IT 
governance in their organisations as a result of this. 
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In addition, it has been discovered that one of the most significant drivers 
of IT governance in organisations is the requirement to match business 
decisions with IT decisions. All IT decisions are made to satisfy business 
expectations and obligations; they are no longer done in isolation. From 
that angle, a successful alignment occurs when business and IT work 
together to accomplish a common objective. 


However, there are risks associated with using IT. The best method to 
recognise and control IT risks is through governance. Investing in technologies 
that ultimately do not provide business benefits is one of the biggest dangers. 
Organisations have come to the realisation that the high capital requirements 
for IT investments in the past were not maximising true business value. This 
resulted from a misalignment of business and IT directions because business 
was not involved in IT decision-making. The biggest IT risk is that IT will fail 
to generate business benefits, resulting in expenditures without any 
additional value to the company. All business units are involved in IT 
governance decisions, which results in the management of IT risks. 


Beyond that, organisations are motivated to implement IT governance 
by a need to fulfil obligations, particularly when board directions on IT 
governance are involved. From the top down, directives are pushed for IT 
governance by the boards and executive management. The structures in 
charge of IT governance are left with no choice but to put it into practice 
because it becomes a part of their obligations. 


Government and other statutory organisations also have an indirect 
impact on businesses and how they conduct their operations. Government 
rules, laws and acts are the main sources of influence. Legislation and 
regulatory compliance are enforced by organisations to control IT. Public 
safety is the goal of this act, which includes the PoPIA. The act has an 
impact on how businesses run because compliance is required; otherwise, 
businesses risk fines and reputational damage. 


Stakeholder and shareholder assurance is one of the key driving forces 
behind the introduction of IT governance in businesses. Investors are now 
more aware of the importance of evaluating an organisation’s governance 
policies before making an investment decision because of past governance 
scandals in organisations that forced the closure of the affected businesses. 
Investors are attracted to good and sound governance standards; hence, 
organisations are considering implementing IT governance in order to 
uphold investor confidence and enforce strong governance procedures. 
For different stakeholders to share their worldviews about IT, IT governance 
promotes a shared understanding of IT. Stakeholders can communicate 
about IT decision-making in a common language thanks to IT governance. 
The achievement of a shared IT objective is facilitated by the mutual 
understanding of various business representatives in committees. 
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Additionally, better decision-making is produced by IT governance because 
IT decisions are no longer made in isolation. Without a clear goal in mind, 
IT investments are expensive for organisations to make and have a high 
capital demand. In this sense, IT investments are made to meet business 
expectations, which increases company value. Better decisions are made 
possible through inclusive IT decision-making between IT and business. 


Similarly, a lack of IT governance causes duplication in IT systems. 
Because of the lack of appropriate inclusive decision-making processes, 
organisations have been investing in IT at random. In the same organisations, 
several departments and divisions are supported by various IT systems 
that almost execute the same activities. Information technology governance 
has been implemented by organisations because of the need to eliminate 
duplication caused by IT systems. One of the motivators for the governance 
of IT has been identified as the necessity to overcome systems integration 
issues. In the absence of IT governance, several IT systems for various 
departments within the same organisation were purchased. Uninformed IT 
system acquisition leads to a variety of systems with integration issues. It 
becomes difficult to move data from one system to another and share data 
between systems. As a result, IT governance is looked to for solutions to 
the system integration issues. 


Health care is now implementing its governance because of its growing 
reliance on IT. Deriving the promised benefits and controlling the dangers 
that IT entails are difficult without adequate IT governance. Organisations 
have been pushed to think about IT governance to realise its commercial 
benefits as a result of the rising reliance on IT for strategic business. 
Businesses must make a variety of judgements about a range of IT initiatives. 
The expenses, advantages to the business, and levels of priority among 
these projects vary. Information technology governance offers organisations 
and top management direction so they can prioritise projects intelligently. 
A project’s business contribution is now taken into consideration while 
evaluating it, along with other crucial business factors like competencies 
and expected return on investment. Technology adoption rate has been 
highlighted as a key factor in IT governance. Business procedures that rely 
largely on IT have compelled concerned organisations to give IT governance 
substantial thought. 


Information technology governance has grown in importance as 
organisations’ understanding of IT has improved. Information technology 
was previously thought of as a support role apart from other important 
business tasks. The governance of IT activities and investments as a result 
received little attention. However, throughout time, IT appreciation has 
increased because of shifting viewpoints on its significance and business 
enablement. 
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Boards and senior management have set strong examples by drawing 
attention to and acting on the issue in their individual organisations as IT 
governance has become a focal point in organisations across many sectors. 
The boards’ impact and debate of the phenomena, which resulted in 
directions for organisations to implement IT governance, has been identified 
as one of the causes of the implementation of IT governance in organisations. 
Organisations use money on IT to achieve a variety of objectives. The 
targets’ achievement has forced significant thought into the implementation 
of IT governance. Information technology governance is thought to 
maintain IT IS progress towards achieving the established business goals. 


Even though organisations work hard to steer IT through its governance, 
without sufficient IT governance, investments in IT are made haphazardly 
and spontaneously without adequate knowledge regarding the need and 
demand for such investments. The final effect could be inadequate or 
excessive spending on IT infrastructure that is not put to good use for 
business growth. Information technology governance directs IT spending, 
ensuring that money is only spent on IT that benefits the company. 


In addition, one of the important reasons for IT governance has been 
recognised is IT cost optimisation. Organisations strive to soend money on 
IT in industries that offer a good return on investment. Furthermore, without 
appropriate IT governance policies, it might be difficult to maintain a 
balance between business expenses and IT spending for valid reasons. 
Organisations have experienced service interruptions, prolonged system 
downtime and financial loss. Because of the lack of IT governance tools to 
address these issues, it was determined that the lack of appropriate 
measures was to blame. One of the key motivators for organisations to 
pursue IT governance is business continuity and recovery. 


The results are in line with the literature, which claims that organisations 
are driven to incorporate IT governance by a variety of internal and external 
reasons (Xue, Liang & Boulton 2008, p. 69). Diverse IT governance drivers 
in the form of various difficulties and expectations make its execution 
necessary (Hoving 2007, p. 150; Luftman & Kempaiah 2007, p. 136). The 
literature also claims that internal and external forces, such as corporate 
values, competitive environments, and external political and economic 
settings, are what primarily maintain the drivers (Guldentops 2014, p. 5). It 
is essential to identify IT governance drivers in both the internal and 
external environments given the ever-changing business and economic 
environment (ISACA 2014, p. 35). The results also confirm that one of the 
factors influencing IT governance is the requirement to adhere to rules and 
regulations (De Haes & Van Grembergen 2006a, p. 7). 


The results also corroborate ITGI’s (2011, p. 2) assertion that the most 
crucial factor in enterprise IT governance is ensuring that current 
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IT capability is in line with current business requirements. The report also 
revealed that one of the primary forces behind IT governance is the desire 
for better risk management (ITGI 2011, p. 2). According to the literature, 
another important motivation for IT governance in the study has been 
highlighted as the desire to deliver IT value (Kan 2004, p. 3). Every 
organisation operates in a different environment, and this environment is 
shaped by both internal and external influences, including organisational 
culture, risk appetite and changing business strategies. As a result, every 
organisation needs its own governance framework (ISACA 2014, p. 45). 
The study’s findings identified factors that were unique to the organisations 
under examination and the health care sector. Organisations are pushed 
into IT governance by a variety of internal and external push forces, which 
make up the drivers. The deployment of IT governance was described 
qualitatively in this section. Through the presentation of qualitative study 
results on how organisations are implementing IT governance in the health 
care industry, the section below addresses the second research question. 


E information technology governance 
implementation results 


Information technology governance is reportedly being applied in a variety 
of ways, including structures, procedures, and relational mechanisms, 
according to participants who were interviewed. The interviewees believed 
that their organisations are primarily driving the implementation process. 
The implementation process used a top-down approach, with directives 
from boards and executive management emphasising the necessity to 
begin implementing an IT governance structure. As every expenditure in IT 
governance must be thoroughly justified, the majority of interviewees 
believed that a pragmatic approach to implementation was the best 
strategy. Furthermore, they emphasised that gaining management support 
for IT governance projects requires a risk-based approach to IT governance. 
The interviewees’ quotes, which are included below, provide evidence that 
the organisations’ use of IT governance is in line with the ideas expressed 
earlier. 


According to the IT governance officer: 


‘Our CIO sits on the executive committee and the audit committee of the board 
of directors. We have an IT steering committee, an IT governance function, a 
GRC manager, IT governance and compliance officers, an IT security committee, 
an information security officer, a group risk officer, and a ClO who likely reports 
to the CEO. (IP6, participant, n.d.) 


According to the other IT governance officer: 


‘We have the IT balanced scorecard, service level agreements, the Cobit and 
King Ill IT governance framework, self-assessments, a project office, IT budget 
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and control, and management reporting for our governance status. We also 
have the IT balanced scorecard, portfolio management for business cases when 
we look at our projects and return on investment (ROI), and the IT balanced 
scorecard.’ (IP7, participant, n.d.) 


Further stating that the following related mechanisms were taken into 
consideration and that: 


‘Knowledge management on IT governance is undoubtedly important, with 
senior and executive management serving as an excellent example because 
we were able to secure significant support from senior executives across a 
number of boards committees, audit committees, risk committees, executive 
committees, and informal meetings between business and IT. We have a close 
relationship with our IT, and the group risk department plays a key role in 
many of the activities we carry out. We run awareness-raising campaigns for IT 
governance, which will undoubtedly increase once COBIT is operational, but we 
currently do so to a certain extent. We also regularly conduct internal corporate 
communications involving IT on a monthly basis. We don’t conduct co-locations 
because of the early stage at which we are now operating. Cross-training is not 
a practice.’ (IP6, participant, n.d.) 


A member of the IT governance team said: 


‘Your job is to implement, but be sensible and pragmatic; if your system only 
completes 80% of what has to be done, maybe deliver 80% instead of 100%. 
At that moment, a budget increase is not required to seek the best goods that 
address the targeted goals.’ (IP8, participant, n.d.) 


The risk manager stated: 


‘People, there is no blame check, and we must defend and demonstrate the 
value and purpose of every investment we attempt to make. This is challenging, 
but it means that by the time we arrive, you will have given it some thought 
and will be honest in your assessment of whether the processes you have in 
place are effectively addressing the risk. Given the admiration for the risk-taking 
approach and our conviction that this is the solution, we frequently discover 
that we are accepted for the funding for it. This is exactly why it takes a lot of 
work to get to that position.’ (IP8, participant, n.d.) 


An IT governance officer stated: 


‘It requires a lot of tact, and you have to choose your important buttons well, 
but ultimately | think my opinion on it... Everyone else, including my colleagues, 
| believe, approaches things from a factual standpoint. We don’t try to persuade 
you to do anything; instead, you examine the risk and consider our facts, your 
viewpoint, and your arguments. When a risk is significant and real and you need 
a solution for it, you have the talk on that premise. If your goal is to reduce the 
risk and improve the situation of the organisation, people are inclined to listen.’ 
CIP6, participant, n.d.) 


The CIO stated: 


‘The business also values that approach, in my opinion, if we think we are 
reducing a possible risk before it even arises. Due to the fact that we are now 
executing 36 COBIT objectives and purchasing software everywhere, there is 
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no blame to be assigned. It’s not how we operate; rather, we take a pragmatic, 
hands-on approach to finding and implementing the answers we need right 
away to reduce the risks associated with our situation.’ (IP10, participant, n.d.) 


The CIO also stated: 


‘| believe that external consulting firms can offer some assistance with 
implementation, but in the end, it will be the workforce that is required to carry 
out the work. Knowing that someone from within the organisation, the full- 
time employee, will always have to undertake the task short of actually hiring 
additional workers, consulting firms serve their purpose, but not in the long run,’ 
(IP10, participant, n.d.) 


Additionally, research organisations showed that structuring structures, 
then procedures and last relational mechanisms come first in the 
implementation process. The majority of those surveyed mentioned the 
existence of mechanisms that facilitate IT governance, including 
committees and positions that focus on this issue. An overview of the 
journey organisations are taking to implement IT governance is shown in 
Figure 5.1. 


According to those questioned, the creation of IT governance systems 
has received a lot of thought. Structures such as governance committees 
and IT governance roles and duties are in charge of overseeing the execution 
of IT governance. They also supervise the execution of IT governance 
processes after the development of IT governance structures. However, 
none of the interviewees supported the idea that their IT governance 
included relational processes. The participants mentioned that they will 
look at relational techniques in the future when IT governance maturity 
increases. 


The study also showed that a cycle-like structure governs the 
deployment of IT governance. The initial step entails selecting and 
prioritising controls. The controls are chosen based on their significance 
in connection to the risks to be mitigated, and this work is carried out by 


Relational 
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IT governance implementation process 


Source: Adapted from Mangundu (2017, p. 115). 
Key: IT, Information Technology. 


FIGURE 5.1: Stages in information technology governance implementation. 
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risk management units in collaboration with IT governance teams. The 
second activity entails putting the chosen controls into action, during 
which process and control owners are chosen and charged with 
maintaining the controls. Finally, evaluations of the imposed controls are 
performed to see whether they are functioning as intended. It has been 
said that the audit and assurance function include reviewing controls. 
Figure 5.2 shows the structures involved in the IT governance controls 
implementation cycle. 


Implementation is based on a prioritisation of controls that is guided by 
the most significant risks in the business environment, as shown in 
Figure 5.2. Prioritisation is used to determine how to implement IT 
governance projects. After measures are put in place, audit and assurance 
functions examine the controls to determine how well they work to reduce 
the risks that they are intended to do so. The approach is repeated until the 
controls are effective in achieving the desired goals. 


It has been discovered that the most typical method used by investigated 
organisations to adopt IT governance is a top-down strategy. As a result, 
the board of directors and top management issue instructions and directives 
emphasising the necessity of starting the road towards IT governance. The 
top-down strategy attempts to solve problems like change resistance, and 
the structures in charge of implementation are left with little choice but to 
start using it. In addition, a top-down strategy results in the integration of 
IT governance into the regular tasks and obligations of the organisations in 
charge. 


Additionally, organisations adopt IT governance by using a risk-based 
strategy in order to persuade and win over upper management support. 
The function of risk management identifies significant threats to the 
business and suggests suitable countermeasures. A risk management 
strategy places a strong emphasis on IT governance. In that sense, it 
demonstrates the critical role IT governance must play in removing the 
hurdles from a managerial standpoint. The strategy makes it easier to 


Prioritisation of Implementation Reviewing of 
controls of controls controls 
Risk management IT management 


Audit and assurance 
IT governance teams IT governance teams 


Source: Adapted from Mangundu (2017, p. 116). 
Key: IT, Information Technology. 


FIGURE 5.2: Information technology governance implementation cycle. 
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get the support of higher levels of management for IT governance 
projects. 


Results show that organisations are implementing IT governance efforts 
in phases rather than all at once, and that this is not a one-day event. 
Relevant controls are found to address the risks found after the risk-based 
approach. The installation of IT governance is done in stages, starting with 
the most crucial controls and moving on to audit and assurance to determine 
whether the goals were achieved. The second set of controls is implemented 
based on risk prioritisation if the first set of controls chosen meets the 
requirements. Guidance is provided on how to accomplish the specified 
implementation objectives by internal and external assurance. The audit 
evaluates if control owners are present, how the control is implemented 
and whether it adheres to predetermined standards. The audit also makes 
it easier to update boards and top management on the status of IT 
governance projects. 


The study discovered that the studied organisations have incorporated 
a variety of structures, procedures and relationship mechanisms. This is 
consistent with the literature, which shows that a variety of structures, 
procedures and relational mechanisms are primarily used to deploy IT 
governance. Importantly, this study found additional evidence that when 
organisations implement IT governance, the creation of pertinent IT 
governance structures is the first step. After that, the structures put into 
place procedures that support IT governance. Relational mechanisms as a 
means of implementing IT governance receive little to no attention, while 
more focus is placed on creating the structures that facilitate the procedures. 
This illustrates that higher level methods, such as relational mechanisms, 
are used in the implementation of IT governance. 


Additionally, organisations choose a variety of structures, procedures 
and relational mechanisms to meet their particular issues. Information 
technology governance is not a ‘one-size-fits-all’ concept. The choice of IT 
governance strategies is made based on pragmatism and implementation 
methods. Organisational resources, expectations and capabilities serve as 
the basis for implementation. Given that IT governance requires resources, 
it may not always be ideal to apply a framework at its highest level of 
maturity. There are other ways to show strong IT governance outside of 
having a fully developed IT governance ecosystem. Information technology 
governance is implemented by organisations at a level sufficient to address 
the risks in their operating environment. 


The results are in line with several studies described in the literature, 
which claim that a combination of relational mechanisms, structures, 
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and procedures is used to implement IT governance (De Haes & Van 
Grembergen 2009, p. 123). Determining the mix of implementation 
strategies is a difficult process that depends on numerous organisational 
elements as IT governance implementation is based on various and 
changing internal and external factors (Patel 2004, p. 20; Ribbers, 
Peterson & Parker 2002, p. 2). Patel (2004, p. 20) and Ribbers et al. 
(2002, p. 1) further contend that, while being in the same industry, the 
ideal combination will differ from organisation to organisation. The 
findings corroborated the literature and demonstrated the undeniable 
existence of IT governance structures and procedures. Relational 
processes, however, were not firmly established in the study as a 
component of how organisations are carrying out IT governance. Patel 
(2004, p. 20) emphasises that various organisations may require various 
combinations, sets, or sets of structures, processes and relational 
mechanisms depending on their requirements. 


The findings do, however, contribute more to the body of knowledge 
regarding the actual implementation methods for particular structures, 
processes and relational mechanisms. Importantly, the findings show that 
implementing IT governance is a never-ending process. Organisations must 
adopt new and changed IT governance strategies because of the always- 
evolving business contexts. In that sense, IT governance should not be a 
one-time thing; rather, it should be a continuous activity. Because IT 
governance frameworks are significant undertakings, treating their 
implementation as an event puts pressure on organisations. The staged 
approach, where implementation is based on prioritising the most crucial 
parts of the frameworks first, is preferred for organisations. Based on the 
importance of the risks they are meant to manage and control, the 
governance elements are ranked. 


The establishment of IT governance must involve the board and executive 
management to promote a top-down approach. A top-down strategy 
makes it easier to get through change resistance, which is one of the 
obstacles to adoption. Additionally, resources for implementation, including 
extra people, money and time, are assured to be directed towards 
implementation with management directives and support. The part that 
follows discusses IT governance inhibitors after this one has reported on 
qualitative results regarding the use of IT governance. 


E information technology governance 
inhibitor results 


Based on the qualitative interviews conducted at the organisations 
under investigation, the obstacles that prevent the implementation of 
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IT governance in health care are presented and discussed in this part. 
Most interviewees agreed that internal organisational issues are what 
hinder IT governance; by contrast, the external environment had little 
influence on this issue and played no part in its implementation. Most 
interviewees believed that limitations on human and financial resources 
were impeding the adoption of IT governance within the context of 
organisational problems. Additionally, the majority of interviewees agreed 
that obstacles to IT governance included a lack of IT appreciation, 
complexity of IT governance, lack of prioritisation of IT governance, a lack 
of knowledge of IT governance, a high effort requirement for implementing 
IT governance, communication issues with IT governance, a lack of 
executive management support for IT governance, conflicting stakeholder 
expectations with IT governance and difficulties prioritising IT governance, 
among others. The quotes from the interviews below support the opinions. 


The IT governance officer emphasised that, ‘In terms of trying to adopt 
this IT governance structure, we are understaffed due to the workload. We 
do not have enough resources because it’s such a big project’. 


The compliance officer stated: 


‘That’s a big obstacle for us. We have a finite amount of IT resources, and these 
resources must both do their daily duties and attend to other concerns, such as 
resolving audit results, working on new projects, and, on top of that, deploying 
Cobit and ensuring that it is done so in an efficient and long-lasting way. As a 
result, it’s not simply about checking boxes or finishing a paper; it truly needs to 
be repeated, which is where the difficulty lies.” (IP3, participant, n.d.) 


The IT governance officer further stated that: 


‘| suppose also spending time with the upper management who might be in 
charge of putting in place some controls. It seems like everyone’s hands are full 
because department heads and everyone else are busy.’ (IP6, participant, n.d.) 


The risk manager commented, ‘I mean, the organisation faces limits. You 
have money constraints, as well as time and priority restrictions’ (IPI, 
participant, n.d.). 


The compliance officer stated that: 


‘The amount of work and resources required to develop a framework like 
this was somewhat overwhelming when they first began the implementation, 
in my opinion because they didn’t fully comprehend its scope. It was 
an expensive process that took three to four years for some of the large 
parastatals to complete because they hired one of the major four consulting 
firms to assist them. Therefore, | believe that they lacked the necessary tools 
to comprehend it, and they didn’t realise how resource-intensive the project 
would be until we got started. | believe there was some initial resistance, 
but it is typical human behaviour when it comes to reluctance to change.’ 
CIP3, participant, n.d.) 
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The IT governance officer said: 


‘Less potential funding, fewer resources, and regrettably, one of the 
difficulties of governance is that it supports ongoing processes by adding 
work to them. Therefore, you need resources if you really want to be ruled. 
If you don’t have the resources, you'll need to strike a balance between 
following regulations to the letter, obtaining an ISO certification, and 
following regulations only to the extent that you think you’ve reduced the 
risks.’ (IP5, participant, n.d.) 


The governance risk and compliance officer said: 


‘People are undoubtedly under stress as a result of the additional administrative 
effort and have to produce documentation. | believe we eventually reach the 
point where we find new controls that were either non-existent or ineffective. 
They may come with additional resources, including, of course, financial 
and human resources, some of which will call for equipment and goods.’ 
CIP3, participant, n.d.) 


The CIO stated: 


‘The difficulties we face in persuading individuals to do this. The realisation of 
how much the organisation depends on IT for the future is something we have 
observed in our firm and the industry as a whole.’ (IP12, participant, n.d.) 


The IT manager commented: 


‘Conversations are now easier—still not easy—but easier as a result of people’s 
growing awareness of the importance of governance and IT to organisations like 
ours and to meeting their demands.’ (IP13, participant, n.d.) 


He stated further: 


‘The objective or perception was that unless you contributed to my primary 
business, why would | have to do this? We had enough problems to go 
around and try persuading people that this is something we have to pursue. 
A few years ago, the budget was reduced because it wasn’t appreciated for 
its intended use and function. We are now beginning to notice that people 
have acquired this knowledge, respect, and understanding of the profession.’ 
(IP13, participant, n.d.) 


He added the following: 


‘| believe that IT governance is really complex for the, | suppose for many other 
sectors. However, | believe that the health care industry is particularly at risk 
because any businessperson is required to consider the benefits or return on 
investment. The return on the IT governance programme is difficult to measure. 
When the true question you want to know the answer to is “how can | increase 
my patient base,” how do you measure the worth of creating procedures that 
add through paperwork and administration?’ (IP13, participant, n.d.) 


The CIO stated further: 


‘You know, | think they are put off by technical jargon or because they don’t 
see the complete picture. When it comes to information, speaking the same 
language the person or department understands and delivering information in 
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terms they can understand might be challenging at times because they don’t 
always fully get what you are trying to do. 


‘| believe IT governance and governance in general are quite recent in South 
Africa, so there may be a skills gap, but | believe it is filling up quickly. So, while 
it’s possible that there are skills gaps in IT governance, they are swiftly being 
filled by the industry as a whole. There are definitely enough abilities in this 
country, in my opinion. (IP12, participant, n.d.) 


According to those who participated in the interviews, the degree of IT 
adoption and integration into company processes has a significant impact 
on IT governance. As a result, organisations with poor IT maturity do not 
understand IT governance. Following an organisation’s adoption of IT for 
its operations, IT governance awareness and understanding play a crucial 
role in its execution. After management has become aware of the 
advantages of IT governance through the stages, another barrier that 
organisations must overcome typically takes the shape of a failure to adapt 
to IT governance. The resistance to change in people’s behaviour has been 
described as people-oriented. From the perspectives of the interviewees, 
the barriers to IT governance are depicted in Figure 5.3. 


The study shows that implementation challenges or inhibitors are 
encountered at various phases when organisations implement IT 
governance. Inhibitors resulting from management’s failure to recognise 
the strategic value of IT and its governance are shown in the first domain. 
In this regard, executive management and boards’ failure to acknowledge 
IT governance cause a bottleneck in organisations’ attempts to start IT 
governance conversations and activities. The motivation to implement IT 
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Change to 
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Capacity to facilitate 
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Source: Adapted from Mangundu (2017, p. 122). 
Key: IT, Information Technology. 


FIGURE 5.3: Information technology governance inhibitor phases. 
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governance is impacted by the failure to acknowledge IT as a critical part 
of the business. Less emphasis has been placed on IT innovations and 
greater IT budget cuts are the result of IT being seen as a supporting 
function that is separate from the larger business function. According to 
a report, top management must put out a lot of work in order to properly 
comprehend the significance of IT and recognise its influence as a business 
enabler. 


The relevance of IT governance and management’s understanding of 
it have a dramatic impact on the deployment process. However, even as 
organisations start to acknowledge the importance of IT, inadequate 
understanding of how IT is regulated causes problems for IT governance. 
It takes a lot of work, according to interviewees, to convince top 
management of the business value that IT governance offers. This is 
linked to a dearth of concrete financial metrics for the advantages of IT 
governance. 


As the boards and top management come to understand the need for IT 
governance along the way, several barriers to changing the organisation 
into an adoptive one start to appear. The implementation of IT governance 
is facilitated by providing a supportive corporate environment, which falls 
under the second domain of the inhibitor phase. According to reports, IT 
governance will alter the official and informal relationships that exist in the 
organisations in question, as well as their structures and processes overall. 
The impacted parties, however, are quite resistant to altering the current 
structures and relationships in an effort to create an environment that 
supports IT governance. 


Additionally, organisations are confronted with a distinct set of inhibitors 
after overcoming people-oriented ones, which primarily take the form of 
resistance to change. Block 3 in Figure 5.3 represents this new collection of 
inhibitors. These barriers relate to an organisation’s inability to implement 
IT governance as doing so could result in additional resource demands in 
the form of higher implementation budgets, human resource capabilities, 
IT governance skills, implementation time, and effort needs. Because of 
their close ties to the organisation, these inhibitors are categorised as 
organisational-oriented. 


Organisations have been leveraging the same human resources that 
manage daily company operations to adopt IT governance. Information 
technology structural limitations have been identified as one of the main 
obstacles to IT governance. Organisations’ failure to establish and maintain 
IT structures forces them to make do with subpar ones, which leads to 
muddled reporting and ambiguous IT lines of authority. Information 
technology employment issues have been identified as yet another 
significant barrier to IT governance. Organisations struggle to establish 
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and maintain IT governance because of a lack of competent IT governance 
employees, who are also expensive to hire. 


A significant obstacle to the deployment of IT governance is the lack 
of IT and IT governance capabilities. According to reports, the available 
staff needs instruction in the frameworks and procedures for IT 
governance. Increasing the abilities of the available workforce has been 
difficult because of the decreasing funds allocated for IT efforts. Staff 
members are under pressure because of a lack of skills and staffing 
issues, and they are resistant to change. Although businesses have 
sought to hire outside consultants, these professionals do not understand 
the industry as well as internal staff. Information technology governance 
concerns in the organisations have not been resolved by applying 
general solutions to various circumstances. Investment in IT governance’s 
implementation becomes more challenging because it is difficult to 
demonstrate concrete direct economic benefits from it, and management 
is reportedly diverting more resources to the organisations’ main 
businesses. Convincing upper management to invest in IT governance 
becomes challenging because the ROI is difficult to quantify. This 
economic argument is challenging, particularly in the private sector 
when businesses are motivated by profits. 


Furthermore, it has been reported that implementing IT governance 
requires a lot of time and work. Information technology governance is a 
journey that should not be taken lightly, according to organisations. The 
detailed recording of the controls is demanding on top of daily business 
routines. Implementation puts pressure on the workforce that is on hand. 
The utilisation of many technologies and organisational complications like 
size make it more difficult to manage IT. The governance of large 
organisations using several IT platforms is challenging. Another 
manifestation of organisational complexity is a failure to comprehend how 
businesses operate. 


The study discovered that organisations must deal with an additional 
set of IT governance barriers, which are depicted in the last block of 
Figure 5.3. Disagreement about prioritisation, including the degree of IT 
governance maturity, among IT governance structures and other relevant 
stakeholders is a defining feature of these inhibitors. From the start of the 
implementation process for IT governance, consensus on expectations 
must be reached. One of the biggest obstacles to implementing IT 
governance was discovered to be disagreement, and this kind of barrier 
has not been noted in the literature. 


One of the main problems is dealing with stakeholders’ conflicting 
expectations regarding the maturity and implementation of IT 
governance. The board, top management, internal and external auditors, 
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the risk management team, the governance risk and compliance team, 
and IT management are just a few examples of the various stakeholders 
that may be involved. Information technology governance becomes 
complicated because of the differences in people’s knowledge and 
expectations of IT governance. According to the report, the board, 
executive management, and auditors are overburdened and anticipate 
that IT governance will be applied at the maximum degree of maturity. 
However, governance risk and compliance and IT management, who 
oversee its execution, are aware of the ramifications of implementing IT 
governance and IT governance frameworks and push for its 
implementation to the extent necessary to fulfil organisational risk 
requirements. The execution of IT governance is hampered by the 
disparities in understanding between those who are accountable and 
those who are responsible. Without a common understanding of the 
nature of business, organisations are unable to recognise the most 
significant risks in their operating environment, which has an impact on 
the prioritisation of IT governance controls because it depends on 
knowledge of the most significant risks that need to be reduced by IT 
governance initiatives. 


However, the study finds that IT governance is not regarded as a 
complicated invention, and IT governance complexity has not been 
highlighted. Misunderstandings of the nature of business and the desire 
to adopt IT governance at the maximum maturity level contribute to the 
perception of complexity. Because of the challenges found, organisations 
either fail to begin implementing IT governance or stop doing so. Overall, 
the findings support previous findings in relation to innovation adoption. 
In relation to the DOI and the Technology Acceptance Model (TAM) 
frameworks, which informed the study, findings reveal that inhibitors of IT 
governance are mainly organisationally context-based. Little consideration 
is given to IT governance and external factors that influence IT governance 
implementation. 


The research, which supports the notion that implementation inhibitors 
fall into multiple categories including expression, specification, and 
implementation barriers, is supported by some of the findings (Weill & 
Broadbent 1998, p. 42). Although Luftman, Papp and Brier (1999) noted 
that social and managerial-oriented problems, rather than technical ones, 
prevent alignment between IT and business, the study results showed a 
consensus that managerial-oriented problems are inhibitors of IT 
governance (Luftman et al. 1999, p. 112; Weill & Broadbent 1998, p. 43). If 
top management is involved and committed to IT, it automatically 
becomes a facilitator; otherwise, it becomes an inhibitor. Luftman et al. 
(1999, p. 20) emphasised that managerial commitment and support is the 
most important aspect. Additionally, the results showed that organisational 
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context (internal context of organisations) is the key factor inhibiting the 
implementation of IT governance, which is consistent with the literature. 
The PWC and ITGI study from 2006 showed that organisations have 
powerful forces like resistance to change, improper communication, 
internal politics, resistance to accepting standards, and resistance to 
accepting accountability, all of which can act as barriers to the 
implementation of IT governance. The research also recognised a variety 
of organisational contexts, national contexts, contexts for IT governance 
practices, and environmental contexts as inhibitors to IT governance 
(Othman et al. 2011, p. 13). 


E information technology governance 
performance results 


Information technology governance officer said: 


‘As we develop, | think it’s something we look at. In my opinion, we haven't really 
attempted to assess the impact of the COBIT framework, particularly in relation 
to . We have reached the point where we should really be closing out the first 
step of putting a few controls in place.’ (IP6, participant, n.d.) 


A governance risk and compliance officer stated: 


‘Once we have completed our initial evaluations against those controls, | believe 
we will be able to examine how they work, look for efficiency in the designs 
we use, identify any gaps, and make some changes. It’s only after looking back 
at the data that you realise you might need to make some improvements in 
some areas. Therefore, | believe that given where we are right now, it’s a little 
early to determine whether or not this has improved or positively altered us.’ 
(IP11, participant, n.d.) 


The study discovered that as organisations incorporate IT governance, 
performance is evaluated qualitatively and subjectively. In the early stages 
of its execution, no quantitative approaches have been used. The 
organisations under study began to experience the benefits of IT 
governance, but no unbiased, quantitative techniques have been used to 
assess its effectiveness. Organisations are now implementing IT governance, 
however at the interview stage there is no way to assess IT governance 
performance objectively. The section that follows, which provides a 
summary of findings that were further included in the quantitative survey 
instrument for phase 2 of the study, comes after this section has given and 
examined qualitative findings related to the research topics. 


E Summary of findings 


A summary of the conclusions drawn from data analysis and the 
development of categories in ATLAS.ti is shown in the Table 5.1. 
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TABLE 5.1: Summary of findings. 


Drivers for IT governance 


IT governance 
implementation 


IT governance inhibitors 


IT governance 
performance 


Increased reliance of 
health care on IT 


Need for improved IT 
decision-making 
Stakeholder And 
shareholder assurance 


Business-IT alignment 


Realisation of IT 
governance benefits 


Strategic importance of IT 


Need to give IT guidance 


Achievement of goals 


Board and senior 
management setting an 
example 


Need for improved 
security 


Project prioritisation 


Regulatory compliance 
Better IT risk management 


Business recovery and 
continuity 


Improved service delivery 


Eliminate duplication of IT 
systems 


Improve shared 
understanding on IT 


Business value delivery 


Structures 


Processes 


Relational mechanisms 


Combination of internal 
and external resources 
Policies and procedures 
Top-down approach 


Pragmatic approach 


Phased approach 


Source: Adapted from Mangundu (2017, p. 128). 


Key: IT, Information Technology. 
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Lack of IT appreciation 


Limited knowledge of IT 
governance 


Lack of IT prioritisation 


High implementation 
effort requirement 
Executive management 
buy-in 

Lack of executive 
management support 


Conflicting stakeholder 
expectations 


Prioritisation challenges 
Lack of skills 


Budgetary and financial 
requirements 


Organisational 
complexities 


Time constraints 
Political factors 


Inadequate IT structures 


Resistance to change 
factors 


Inadequate resources 


Challenges of lean IT 
perspective 


Lack of training 
Lack of IT understanding 


IT governance 
complexities 


Business environment 


Inadequate advisory 
services 


Communication problems 


Formal and informal 
relationships 


Lack of coordination 


Inadequate creation of IT 
structures 


Hard to measure 
performance 
Improved clinical 
services delivery 
Enhanced effective 
administrative 
processes 


Chapter 5 


E Conclusion 


The data analysis processes used to respond to study questions from 
qualitative data gathered through semi-structured interviews and 
organisational documentation are described in Chapter 5. The ATLAS.ti 
qualitative data analysis programme was used to aid in theme analysis of 
the data that was gathered. Results from interviews with business and IT 
decision-makers in the organisations under study were reported in the 
chapter. Additionally, it examined and discussed the qualitative study’s 
findings. The qualitative findings were essential for comprehending the 
drivers of IT governance implementation, the manner in which organisations 
are doing so, and, most crucially, the barriers to implementation and 
performance of IT governance. 


The findings centred on what study participants said, giving a thorough 
understanding of what they thought about IT governance in their 
organisations. Therefore, the qualitative research was crucial for confirming 
the organisations’ use of IT governance. The study showed that IT 
governance is a complex issue that necessitates multilevel appreciation. 
The findings also show that organisations confront various IT difficulties 
and demands, which results in a variety of IT governance approaches. 
Organisational environments influence implementation because what 
works well for one organisation may not always be a successful formula for 
another. Organisations may overcome their worries and adopt IT governance 
in a way that satisfies organisational requirements with the support of 
pragmatic techniques. As a result, acknowledging the obstacles gives 
organisations excellent flexibility in how they might approach the problem 
of IT governance, facilitating the adoption of that solution. 


By referring back to the literature review and subsequently to the more 
general IT governance theories, the discussion established a connection 
between theory and practice based on the empirical findings of the research 
questions. Through comparison, contrast and discussion of the results, 
relevant concepts are discovered, changes are acknowledged and an 
academic attempt is made to develop well-informed arguments about the 
application of IT governance in organisations. Integrating qualitative 
findings with the quantitative component was essential to enhancing the 
validity of the research findings. After presenting and discussing the 
qualitative results in this chapter, the next chapter will discuss the outcomes 
of the quantitative data. 
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Presentation, interpretation 
and analysis of quantitative 
data 


E introduction 


Chapter 5 presented and discussed results from qualitative data gathered 
using the interview guide and from study organisation materials. Results 
from the previous chapter were determined by conducting a qualitative 
examination of the data. The findings from the first portion of the study are 
expanded upon in this chapter (quantitative phase), which is a follow-up 
to the qualitative phase. In addition to providing answers to some of the 
concerns that could not be fully addressed during the qualitative phase, 
the quantitative results are helpful in triangulating some of the qualitative 
results and strengthening their credibility. 


E Linking Phase 1 and Phase 2 


The study questions were addressed by qualitative findings, which were 
also used to improve the data collection tool (questionnaire) for the 
following stage. The researcher used the findings from the qualitative 
phase to become familiar with the organisations under investigation and to 
specifically target respondents for the next stage. Using a purposive 
sampling technique, respondents from the qualitative phase were increased 
for the quantitative phase in order to respond to the study questions. 
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Purposive sampling was used to choose respondents, which made it easier 
to find those with a useful understanding of the topic at hand. Additionally, 
gatekeepers helped in locating some of the respondents who were unable 
to participate in the qualitative phase. Using the scientific sample size 
estimation techniques from Morgan’s table and SurveyMonkey, which 
recommended a minimum sample of 108 to produce reliable results with a 
5% margin of error and a 95% confidence level, a sample of 120 from a 
population of 150 respondents proved to be scientifically adequate. 


Construct frequencies 


The relationship between the qualitative and quantitative phases was covered 
in the preceding section. This section describes the quantitative data’s 
statistical processing and how constructs were quantified. According to the 
Likert scale, which ranges from the lowest (strongly disagree, 1) to the highest 
(strongly agree, 5), constructs were measured. In order to do statistical 
calculations like t-tests, analysis of variance, correlations and regression 
analysis, the analysis was based on the calculation of construct scores. 
Standard deviations and frequencies are included in descriptive statistics and 
are shown in tables and graphs. To ascertain whether there are any statistically 
significant correlations between the two variables included in the cross- 
tabulation, the chi-square test of independence was used for the data. 
Furthermore, binomial tests are used to determine whether a sizable majority 
of respondents choose one of two alternative answers. To determine whether 
a mean score differed significantly from a scalar value, a one-sample t-test 
was performed. Finally, independent sample t-tests were used to compare 
two different case groups. Only tables that are directly related to the issues 
being investigated are included in the chapter. On request, a complete 
statistical analysis output is available. The demographic information for the 
organisations and survey respondents is included in the section after this one. 


Demographic characteristics 


The business type of the respondents’ companies, the services and goods 
they offer, their positions and length of time in management, the proportion 
of IT staff employed by the organisation, the importance of IT issues, how 
frequently these issues were brought to management’s attention, and 
the alignment of IT strategy and business strategy were among their 
demographic characteristics. 


According to Figure 6.1,64% of respondents to the poll worked in private 
health care, whereas 36% did so in public health care. Those who made 
business and IT decisions made up most of the respondents; however, 
some came from other departments. Fifteen per cent of responders were 
auditors, with 12% coming from governance, risk and compliance. 
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Source: Adapted from Mangundu (2017, p. 132). 
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FIGURE 6.1: Organisational profile. 
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Source: Adapted from Mangundu (2017, p. 133). 
FIGURE 6.2: Respondents’ experience levels in management. 


Figure 6.2 demonstrates that 41% of people had one to three years of 
managerial experience, 27% had between four and seven years of managerial 
experience, 48% had between eight and eleven years of managerial experience 
and 25% had between twelve and fifteen years of managerial experience. 
Between one and 25 IT employees made up approximately 21% of respondents, 
between 26 and 50 IT employees made up about 16%, between 76 and 100 IT 
employees made up 0.8%, and the majority of 62% had more than 100 IT 
employees. According to analysis, IT is employed much more often than other 
business practices (m= 4.57, SD = 0.513, t [121] = 33.889, o = 0.0005). Significant 
relevance is shown for IT in sustaining business in organisations (m = 4.46, 
SD = 0.670, t [121] = 24.058, p = 0.0005). Meeting and board agendas feature 
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IT concerns quite frequently (m = 3.98, SD = 0.530, t [121] = 20.505, p = 0.0005). 
The findings show that in the studied organisations, IT is widely used and 
esteemed as a crucial strategic business tool. The results, however, also show 
that as the outcomes were not significant, no inference can be drawn about 
the alignment of IT strategy with business strategy. After presenting the 
demographics, this section is followed by the portion that presents the 
outcomes of the IT governance drivers. 


Information technology governance driver 
frequencies 


The demographic details of the respondents and the organisations that 
took part in the study were covered in the previous section. Based on the 
responses gathered from the organisations that participated in the online 
survey, this section covers the frequency of IT governance driver events. 
The one-sample t-test was used to determine whether the drivers of the 
adoption of IT governance are genuinely in place by determining whether 
the average score for drivers is significantly different from ‘3’. 


The results of the analysis show that there are strong IT governance 
drivers in the health care industry (m = 4.3607, SD = 0.31582, t [121] = 47.587, 
p = 0.0005). The requirement to ensure that business plans and IT plans are 
in sync considerably motivates organisations to establish IT governance, 
according to further research (m = 4.77, SD = 0.441, t [121] = 44.305, 
p = 0.0005). Additionally, IT governance supports organisations in timely 
decision-making (m = 4.07, SD = 0.639, t [121] = 18.406, p = 0.0005). 
Information technology risks can be managed by organisations with good 
IT governance (m = 4.89, SD = 0.310, t [121] = 67.502, p = 0.0005). Additionally, 
a significant majority of respondents (m = 4.61, SD = 0.507, t [121] = 34.993, 
p = 0.0005) agreed that IT governance enables the organisation to deliver 
value through IT. Information technology governance gives IT advantages in 
terms of strategy and competition (m = 3.24, SD = 0.681, t [121] = 3.856, 
p = 0.0005). In addition, the organisation must establish IT governance in 
order to comply with laws and regulations (m = 4.37, SD = 0.795, 
t [121] = 19.027, p = 0.0005). According to the analysis of the findings, the 
organisation is able to accurately measure the performance of IT operations 
and functions (m = 3.57, SD = 0.738, t [121] = 8.460, p = 0.0005). The 
organisation can avoid unfavourable situations thanks to IT governance, 
such as the loss of patient data (m = 3.82, SD = 0.739, t [121] = 12.256, 
p = 0.0005). There is a lot of agreement that the organisational culture 
promotes good governance (m = 3.55, SD = 0.717, t [121] = 8.460, p = 0.0005). 


Additionally, organisations are strongly motivated to implement IT 
governance as a means of guaranteeing quality and excellence in the 
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provision of health care services (m = 3.86, SD = 0.594, t [121] = 16.015, 
p = 0.0005). Similarly, there is broad agreement that governance is 
required because of the growing reliance of business on IT (m = 4.23, 
SD = 0.477, t [121] = 28.448, p = 0.0005). There are numerous advantages 
to implementing IT governance (m = 3.64, SD = 0.604, t [121] = 11.693, 
p = 0.0005). Information technology governance is heavily influenced 
by the requirement to reassure shareholders and stakeholders about IT 
investments (m = 4.81, SD = 0.413, t [121] = 48.417, p = 0.0005). Additionally, 
governance supports the studied organisations by directing IT (m = 4.19, 
SD = 0.503, t [121] = 26.078, p = 0.0005). Additionally, there is broad 
consensus that IT governance assists the organisation in reducing IT 
expenditures (m = 4.29, SD = 0.686, t [121] = 20.717, p = 0.0005). Analysis 
of the data, however, shows that no deduction can be made in relation to 
IT governance, which would result in a decrease in expenses and an 
increase in profits. The results were not substantial because of demands 
from the government to account for significant IT investments. The most 
significant IT governance drivers in both private and public health care 
sectors are displayed in Figure 6.3, making identification simple. 


To optimise IT costs 4.29 
To give guidance to IT 4.19 
Assurance to shareholders and stakeholders on IT investments 4.81 
Many resulting benefits 3.64 
To increased business reliance on IT 4.23 
To ensure that the strategic business plans are aligned to IT plans 4.84 
To ensure quality and excellence in health care service delivery 3.86 
Part of the organisational culture 3.55 
To avoid negative incidents e.g loss of patients’ data 3.82 
Pressure from the government to account for huge IT investments 3.03 
To properly measure the performance of IT functions and operations 357 


A reduction in costs and an increase in profits 2.93 


IT governance drivers 


Legislation and regulatory compliance requirement 4.37 
Creates competitive and strategic advantage 3.24 
To deliver value through IT 4.61 
Allows the organisation to manage IT risks 4.89 
To make timely decisions 4.07 


To align the strategic business plans to IT plans AI 
T T T 1 


1 2 3 4 5 


Disagreement Agreement 


Source: Adapted from Mangundu (2017, p. 142). 
Key: IT, information technology. 


FIGURE 6.3: Information technology governance driver frequencies. 
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Information technology governance driver 
comparative analysis 


Independent sample t-tests are used to analyse whether the IT governance 
drivers differ between the public and commercial health care sectors. The 
findings show that the commercial sector and the public sector have 
significantly higher levels of agreement (m = 4.19, SD = 0.625, and 
m = 3.84, SD = 0.609, respectively) and that timely decision-making is 
what motivates the implementation of IT governance (t [120] = 3.010, 
p = 0.003). However, there is much less agreement that legislation and 
regulatory compliance are drivers for the implementation of IT governance 
in the private sector (m = 4.15, SD = 0.854) than in the public sector 
(m = 4.75, SD = 0.488) (t [120] = -4.906, p = 0.0005). Similarly, there is 
much less agreement in the private sector (m = 2.12, SD = 1.105) than in 
the public sector (m = 4.66, SD = 0.608) that the need for IT governance 
is a result of pressure from the government to account for significant IT 
investments (t [120] = -137 16.408, p = 0.0005). The agreement that IT 
governance enables the organisation to avoid bad situations, such as the 
loss of patient data, is likewise considerably lower in the private sector 
(m = 3.72, SD = 0.754) than in the public sector (m = 4.00, SD = 0.682) 
(t [120] = -2.052, p = 0.402). However, there is a lot more agreement 
that excellent governance as part of the organisational culture is a driver 
in the private sector (m = 3.89, SD = 0.511) than in the public sector 
(m = 3.09, SD = 0.802) (t [120] = 5.349, p = 0.0005). 


Furthermore, there is a lot more agreement that the requirement to 
make sure that the strategic business strategies are in line with IT plans is a 
driver for the implementation of IT governance in the private sector 
(m = 4.90, SD = 0.305) than in the public sector (m = 4.73, SD = 0.451) 
(t [120] = 2.233, p = 0.029). Further findings show that, because of increased 
corporate reliance on IT, there is considerably greater agreement in the 
private sector (m = 4.33, SD = 0.474) than in the public sector (m = 4.05, 
SD = 0.429) on the need for IT governance (t [120] = 3.425, p < 0.001). 
Additionally, there is a lot more agreement in the private sector. IT 
governance is driven by the need to give shareholders and stakeholders 
certainty on IT investments, which is more important in the private sector 
(m = 4.87, SD = 0.303) than in the public sector (m = 4.70, SD = 0.462) 
(t [120] = 2.055, p = 0.043). Giving IT direction is a driver for IT governance, 
and there is a lot more agreement about this in the private sector (m = 4.29, 
SD = 0.459) than in the public sector (m = 4.00, SD = 0.528) (t [120] = 3.101, 
p = 0.003). Additionally, there is a much greater agreement in the private 
sector (m = 4.38, SD = 0.707 vs. m = 4.11, SD = 0.618) than in the public 
sector (m = 4.11, SD = 0.618) about the fact that IT governance enables the 
organisation to reduce IT expenditures (t [120] = 2.206, p = 0.030). 
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Additional independent sample tests were undertaken to see if there were 
any changes in the level of driver existence between the public and private 
sectors. The findings reveal that there is much higher agreement with the 
existence of IT governance drivers in health care in the private sector 
(m = 4.4343, SD = 0.28542) than in the public sector (m = 4.2301, 
SD = 0.32790) (t [120] = 3.594, p = 0.0005). 


The comparison results show that private health care exhibits a stronger 
recognition of the drivers than public health care, even though IT governance 
in health care is generally present. The motivations behind private health 
care’s IT governance initiatives are well understood. Results show that in 
contrast to private health care, public health care is more influenced by 
outside forces like legislation, the regulatory environment and political 
pressure. The drivers of IT governance in both private and public health 
care sectors are summarised in Figure 6.3. The drivers’ diagrammatic 
representation is shown in the picture, with the highest mean values 
belonging to the most identified drivers. 


The requirement to guarantee that IT and business plans are aligned, 
assurance to stakeholders and shareholders, and risk management are the 
three main drivers of IT governance, according to Figure 6.3. This includes 
the delivery of IT business value, IT cost optimisation, IT coaching and the 
requirement to adhere to legal and regulatory requirements. The need to 
lower expenses and boost profitability was the least important motive. 
After providing IT governance drivers in the previous section, the following 
sections show IT governance implementation results. 


Information technology governance 
implementation frequencies 


The results of the analysis show that IT and its governance are very 
important to both commercial and public health care organisations 
(m = 4.56, SD = 0.531, t [121] = 32.404, p = 0.0005). However, there is a lot 
more agreement that IT governance is important in the private sector 
(m = 4.71, SD = 0.459) than in the public sector (m = 4.30, SD = 0.553) 
(t [120] = 4.392, p = 0.0005). Given the significance of IT and IT governance 
to the organisations, they are actively working to execute it, utilising various 
entities to varying degrees. 


Analysis reveals varying degrees of reliance on various entities by 
organisations for the execution of IT governance as demonstrated in 
Figure 6.4. For the most part, health care organisations rely heavily 
on internal IT governance teams (m = 4.70, SD = 0.528, t [121] = 35.470, 
p = 0.0005) and external advisers (m = 3.67, SD = 0.732, t [121] = 10.138, 
p = 0.0005) to execute IT governance. Additionally, for the implementation 
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Source: Adapted from Mangundu (2017, p. 143). 
Key: IT, information technology. 


FIGURE 6.4: Information technology governance implementation frequencies. 


of IT governance, organisations depend less on the National Department of 
Health (m = 2.33, SD = 1.797, t [121] = -4.130, p = 0.0005) and the Department 
of Public Service and Administration (DPSA) (m = 2.37, SD = 1.846, t [121] = 
-3.776, p = 0.0005). 


Comparative investigation, however, reveals disparities in how much 
private and public health care organisations rely on the organisations for 
the implementation of IT governance. Public health care (m = 3.95, 
SD = 0.728) relies much more on external consultants for implementing 
IT governance than private health care (m = 3.53, SD = 0.728, t [120] = 
-3.040, p = 0.003). Contrarily, internal IT governance teams are significantly 
more relied upon by private health care (m = 4.79, SD = 0.466) than by 
public health care (m = 4.52, SD = 0.590) to implement IT governance 
(t [73.483] = 2.631, o = 0.010). Additionally, analysis shows that public and 
private health care sectors are much more in agreement about how much 
they depend on the National Department of Health to implement IT 
governance (m = 4.59, SD = 0.726 vs. m = 1.05, SD = 0.453) (t [62.300] = 
-29.300, p = 0.0005). In addition, analysis reveals that public and private 
health care sectors are much more in agreement about how much they 
depend on the Department of Public Service and Administration for 
implementing IT governance (m = 4.73, SD = 0.694 vs. m = 1.04, SD = 0.340) 
(t [54.838] = -33.081, o = 0.0005). 


Analysis reveals that COBIT is the framework that is most frequently 
used to execute IT governance in both private and public health care 
sectors (mM = 4.94, SD = 0.234, t [121] = 91.885, o = 0.0005). Both commercial 
and public health care IT governance recommendations from the King Ill 
study are taken into consideration (m = 4.80, SD = 0.439, t [121] = 45.410, 
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p = 0.0005). As an IT governance implementation framework, Val IT 
(m = 3.86, SD = 0.696, t [121] = 13.656, o = 0.0005) compares favourably to 
ITIL (m = 3.83, SD = 0.897) and ISO (m = 3.64, SD = 0.644). 


Regarding the degree to which the COBIT framework is used for IT 
governance, there is noticeably greater agreement in the commercial 
sector (m = 4.99, SD = 0.113) than in the public sector (m = 3.86, SD = 0.347) 
(t [48.219] = 2.293, p = 0.026). Additionally, there is a lot more consensus 
about how much the VAL IT framework is used for IT governance in the 
private sector (m = 4.08, SD = 0.576) than in the public sector (m = 3.48, 
SD = 0.731) (t [73.361] = 4.683, p = 0.0005). Furthermore, there is greater 
consensus regarding the degree to which the ISO 27001, 27002 and 38500 
frameworks are used for IT governance in the private sector (m = 3.74, 
SD = 0.521). Regarding the degree to which the ITIL framework is applied 
to IT governance, there is much greater agreement in the commercial 
sector (m = 4.10, SD = 0.749) than in the public sector (m = 3.34, SD = 
0.939) (t [74.086] = 4.617, p = 0.0005). Additionally, there is a significantly 
greater agreement regarding the degree to which the King III framework is 
followed for IT governance in the private sector (m = 4.90, SD = 0.345) 
compared to the public sector (m = 4.64, SD = 0.532) (t [63.829] = 2.925, 
p = 0.005). The findings in each case show that the commercial sector uses 
the frameworks more extensively than the public sector. 


The implementation of IT governance frameworks makes use of 
both internal and external resources. According to Z approximation, all 
techniques were significantly implemented: top-down (98%, p = 0.0005), 
pragmatic (66%, p = 0.0005), risk-based (93%, p = 0.0005), phased (80%, 
p = 0.0005) and implementation through prioritisation (85%, p = 0.0005). 


The chi-square test of independence is used to compare different 
industry sectors. When the conditions were not met, Fisher’s exact test 
was used. According to the analysis, there is a strong correlation between 
the top-down methodology’s use and the sector (p = 0.045). Unexpectedly, 
more public corporations than predicted do not employ the top-down 
strategy. Additionally, there is a strong correlation between the sector and 
the application of the pragmatic approach (p = 0.0005; 2 [1] = 101.278). The 
pragmatic approach is used by private companies more frequently than 
predicted but less frequently by public companies. 


Sector and the application of the risk-based strategy are significantly 
correlated (po = 0.001). The public sector does not employ the risk-based 
strategy as frequently as would be expected. Sector and the application 
of the phased technique are significantly correlated (2 [1] = 47.513, 
p = 0.0005). The amount of public firms not using the phased method is 
higher than projected, whereas private companies do. 
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FIGURE 6.5: Information technology governance frameworks frequencies. 


Through the prioritisation method, there is a substantial correlation 
between sector and implementation (o = 0.0005; 2 [1] = 30.826). In 
contrast to public health care, the private health care sector prioritises its 
initiatives. A review of the variations in the implementation strategies used 
across sectors is shown in Figure 6.5. 


All of the aforementioned IT governance implementation strategies are 
more common in the private sector than in the public sector, as shown in 
Figure 6.5. Both the corporate and public health care industries hold top- 
down and risk-based methods in high regard. Results show a substantial 
difference when it comes to the pragmatic approach, with the private 
sector using it significantly while the public sector does not. The 
establishment of IT governance is prioritised by both private and public 
sector organisations, although private health care receives more attention. 
Results on IT governance frameworks and implementation strategies are 
discussed in this section. As a part of implementing IT governance, the 
following section presents IT governance structures. 


Information technology governance structures 


The qualitative phase showed that structures, processes and relational 
mechanisms are being used by both private and public health care sectors 
to establish IT governance. This chapter’s statistical analysis looks at how 
well the respondents agreed with the findings of the qualitative research. 
Results of the examination of IT governance structures in support of IT 
governance in both private and public health care sectors are presented in 
the section below. Analysis reveals that board-level IT strategy committees 
strongly favour IT governance (m = 4.09, SD = 0.680, t [121] = 33.889, 
p = 0.0005). As a formal structure supporting IT governance, IT audit 
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committees at the board of director level are shown to be of significant 
relevance (m = 4.41, SD = 0.665, t [121] = 23.417, p = 0.0005). Additionally, 
ClOs on executive committees considerably support IT governance 
(m = 4.60, SD = 0.676, t [121] = 26.110, p = 0.0005). In support of IT 
governance in health care, analysis reveals that IT steering committees 
(m = 4.92, SD = 0.303, t [121] = 69.695, p = 0.0005) have the greatest influence. 


The IT governance function/officer (m = 4.16, SD = 0.504, t [121] = 25.514, 
p = 0.0005) plays a significant role in supporting IT governance, according 
to subsequent analysis. The results also demonstrate the large contribution 
that steering committees for IT projects make (m = 3.97, SD = 0.629, t [121] 
= 16.985, p = 0.0005). The security, compliance and risk officer (m = 4.24, 
SD = 0.705, t [121] = 19.397, p = 0.0005) and the CIO reporting to the head 
of department or Chief Operations Officer (COO) (m = 4.66, SD = 0.701, 
t [121] = 26.071, p 0.0005) significantly assist IT governance initiatives in 
health care organisations, according to the results. Information technology 
governance in both private and public health care sectors is highly 
supported by IT 148 governance structures. A comparison of IT governance 
systems across industries is provided in the section that follows. 


O Information technology governance structure 
comparative analysis 


Information technology strategy committees at the level of the board of 
directors support IT governance measures, but there is a noticeably greater 
agreement in the private sector (m = 4.27, SD = 0.617) than in the public 
sector (m = 3.77, SD = 0.677) (t [120] = 4.118, p = 0.0005). Additionally, there 
is more agreement that the IT audit committee at the level of the board of 
directors supports IT governance in the private health care sector (m = 4.58, 
SD = 0.570) than in the public sector (m = 4.11, SD = 0.722) (t [120] = 3.907, 
p = 0.0005). In comparison to the public sector (m = 4.23, SD = 0.886), the 
CIO on the executive committee considerably promotes IT governance in 
the private health care industry (m = 4.81, SD = 0.397). There is a lot greater 
agreement that the IT governance function/officer promotes IT governance 
in the commercial health care sector (m = 4.24, SD = 0.514) than in the public 
sector (M = 4.02, SD = 0.457) (t [98.3577] = 2.448, p = 0.016). 


Information T project steering committees support IT governance 
innovations more frequently in private health care (m = 4.10, SD = 0.616) than 
in public health care (m = 3.73, SD = 0.585) (t (120) = 3.291, o < 0.001). More 
considerable agreement is seen in the commercial health care sector 
(m = 4.28, SD = 0.579) than in the public health care sector (m = 3.59, 
SD = 0.726) with reference to IT security committees supporting IT governance 
(t (74.042) = 5.420, p = 0.0005). Furthermore, there is a lot more agreement 
that IT strategy committees at the level of the board of directors support IT 
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governance activities in the private sector (m = 4.49, SD = 0.597) than in the 
public sector (m = 3.80, SD = 0.668) (t [120] = 5.884, o 0.0005). Finally, there 
is more agreement that IT strategy committees at the level of the board of 
directors support IT governance activities in the private sector (m = 4.91, 
SD = 0.401) than in the public sector (m = 4.20, SD = 0.878) (t [53.291] = 5.043, 
p = 0.0005). A summary of IT governance mechanisms in both private and 
public health care sectors is shown in Figure 6.7. 


E Private YES [J Private NO I Public YES Public NO 


120 5 
100.0 98.7 98.7 98.7 97.4 
100 4 93.2 90.9 


Percentage (%) 
(ep) 
O 


40 4 
20 + 6.8 
O T 
Top-down Pragmatic Risk-based Phased Implementation 
approach approach approach approach through 


prioritisation 


Implementation approach 


Source: Adapted from Mangundu (2017, p. 146). 
FIGURE 6.6: Information technology governance implementation approach frequencies. 
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FIGURE 6.7: Information technology governance structure frequencies. 
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The findings imply that IT governance systems are evident in both 
private and public health care sectors. However, there are large gaps 
in the understanding of the support provided by IT governance 
structures. Overall, private health care and public health care sectors 
were more in agreement about the support that IT governance 
structures should provide. Contrary to expectations, private health 
care has more mature IT governance systems than that of public 
health care. Results of the IT governance processes are provided in the 
next section. 


E Information technology governance 
processes 


Results on IT governance structures were covered in the previous 
sections. The processes used for IT governance in both private and public 
health care sectors are discussed in this section (m = 3.86, SD = 0.469, 
t [121] = 20.263, p = 0.0005), and the analysis of the results demonstrates 
that strategic information systems planning considerably helps IT 
governance in health care. Additionally, IT governance is supported by IT 
performance measurement (such as an IT balanced scorecard) (m = 4.93, 
SD = 0.249, t [121] = 85.962, o = 0.0005). Portfolio management 
procedures significantly support IT governance (m = 3.97, SD = 0.588, 
t [121] = 18.161, o = 0.0005). According to the results, charge-back 
agreements provide significant support (m = 4.01, SD = 0.766, 
t [121] = 14.538, o = 0.0005). Additionally, service level agreements 
significantly aid IT governance (m = 4.97, SD = 0.179, t [121] = 121.516, 
p =0.0005). Additionally, IT governance frameworks (m = 4.96, SD = 0.199, 
t [121] = 108.696, p = 0.0005) and IT governance assurance and self- 
assessment (m = 4.27, SD = 0.668) considerably promote IT governance. 
In addition, project governance/management techniques (m = 7.37, 
SD = 0.515, t [121] = 15.650, p = 0.0005) promote IT governance in the 
health care industry. According to the analysis of the data, IT budget 
reporting and control promote IT governance (m = 3.92, SD = 0.611, 
t [121] =16.594, p = 0.0005). The findings also show that benefit management 
and reporting considerably aid IT governance in both private and public 
health care sectors (m = 4.03, SD = 0.629, t [121] = 18.137, o = 0.0005). 


The researcher conducted a comparative analysis to ascertain the 
variations in the degree to which the processes support IT governance in 
private and public health care sectors independently after realising that 
there is significant agreement that the aforementioned IT 
governance processes support IT governance in both private and public 
health care sectors. The comparative analysis is provided in the sections 
that follow. 
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E Governance process comparative analysis 


Strategic information systems planning is supported by IT governance 
initiatives, according to comparative analysis, which shows that there is 
considerably more agreement in the private sector (m = 3.94, SD = 0.437) 
than in the public sector (m = 3.73, SD = 0.499) (t [79.784] = 2.316, p = 0.023). 
Additionally, the findings indicate that portfolio management supports IT 
governance measures more significantly in the private sector (m = 4.10, 
SD = 0.524) than in the public sector (m = 3.73, SD = 0.624) (t [77.278] = 3.375, 
p < 0.001). Charge-back arrangements promote IT governance activities, 
according to more private sector respondents (m = 4.10, SD = 0.673) than 
public sector respondents (m = 3.73, SD = 0.845) (t [73.930] = 3.375, 
p = 0.004). Information technology governance assurance and self- 
assessment support IT governance initiatives, with more significant 
agreement seen in the commercial sector (m = 4.49, SD = 0.575) than in the 
public sector (m = 3.89, SD = 0.655) (t [120] = 5.267, p = 0.0005). 


Additionally, there is a lot greater agreement that project governance 
and management approaches help IT governance initiatives in the private 
sector (m = 3.86, SD = 0.448) than in the public sector (m = 3.50, SD = 0.550) 
Ct [75.326] = 3.694, p = 0.0005). The findings show that there is still much 
greater agreement about how IT budget control and reporting help IT 
governance initiatives in the private sector (m = 4.04, SD = 0.521) than in 
the public sector (m = 3.70, SD = 0.701) (t [70.112] = 2.758, o = 0.007). In 
addition, the private sector demonstrates more agreement that IT budget 
control and reporting help IT governance activities (t [72.861] = 3.688, 
p = 0.0005) than the 151 public sector (m = 3.75, SD = 0.686; m = 4.19, 
SD = 0.536). The results discussed previously are summarised in Figure 6.7. 


According to a comparative investigation, there is greater consensus 
regarding the existence of IT governance mechanisms in commercial health 
care than in public health care. In contrast to the public sector, processes are 
more well-established and employed to assist IT governance in the private 
sector. However, the findings show consistency in how balanced scorecards, 
service level agreements and IT governance frameworks are used by both 
the private and public health care sectors. The results of the IT governance 
process are presented in this section, and the results of the IT governance 
relational mechanisms are provided in the following chapter. 


Information technology governance relational 
mechanisms 


Significant support for IT governance was found in IT governance processes 
and structures, as discussed in the previous sections. This section covers the 
consensus and dispute regarding the support for IT governance in both 
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FIGURE 6.8: Information technology governance process frequencies. 


private and public health care sectors provided by relational systems. 
Analysis of the data reveals a significant discrepancy regarding the assistance 
for IT governance provided by co-location (m =1.47, SD = 0.517, t [121] = -32.733, 
p = 0.0005). Additionally (m = 1.43, SD = 0.497, t [121] = -35.006, p = 0.0005), 
cross-training does not benefit IT governance activities. Further findings 
show a considerable divide between the support for IT governance in both 
commercial and public health care sectors (m = 1.85, SD = 0.626, 
t [121] = -20.263, p = 0.0005). Information technology governance is 
supported by business/IT account management; however, there is a 
significant gap between the two (m = 1.68, SD = 0.607, t [121] = -24.027, 
p = 0.0005). Further analysis of the data reveals that there is substantial 
disagreement with the idea that senior or executive management sets a 
positive example for IT governance (m = 2.53, SD = 1.062, t [121] = -4.861, 
p = 0.0005). Results show that there is substantial disagreement about the 
support for IT governance provided by informal meetings between business 
and IT executive/senior management (m = 1.75, SD = 0.659), (t [121] = -20.867, 
p = 000.5). Information technology governance is not supported by regular 
corporate internal communication about IT (m = 1.74, SD = 0.736, 
t [121] = -18.935, o = 000.5). Last but not least, the data demonstrate that 
there is substantial disagreement regarding the help that IT governance 
awareness initiatives provide (m = 1.53, SD = 0.533, t [121] = -30.408, 
p = 0000.5). Overall findings show that relational methods for IT governance 
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do not assist IT governance in both private and public health care sectors. To 
identify the differences in the conflicts surrounding the usage of relational 
mechanisms for IT governance, additional investigation was conducted 
across industries. The outcomes are given in the section that follows. 


Information technology governance relational 
mechanism comparative analysis 


A comparison of relationship mechanisms between private and public 
health care sectors was conducted to see if there are any differences. 
Comparative examination between sectors, however, does not find any 
appreciable variations in the degree to which relational mechanisms 
enable IT governance. Conflicting IT governance relationship mechanisms 
are shown in Figure 6.9. 


According to respondents, relational mechanisms for IT governance are 
not generally supportive of IT governance in both private and public health 
care sectors, as seen in Figure 6.9. 


Additional research was conducted to identify the structures, procedures 
and relational mechanisms that greatly contribute to IT governance in both 
private and public health care sectors. The outcomes are displayed below. 
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FIGURE 6.9: Information technology governance relational mechanism frequencies. 
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Information technology governance 
implementation further tests 


The weighting of IT governance structures, procedures and relational 
mechanisms was statistically determined, as well as which of the three 
most strongly supports IT governance for health care generally and across 
industries. Cronbach’s aloha was used to evaluate the consistency of 
integrating these variables. A number > 0.7 denotes a trustworthy 
measurement. These composite measures underwent analysis to determine 
whether there is a statistically significant difference between them. To 
check for significant differences between two of the metrics, a paired 
samples t-test was used. 


Results show that there is much higher agreement with the support for 
IT governance efforts provided by IT governance structures (m = 4.3415, 
SD = 0.38494) as opposed to IT governance processes (m = 4.2648, SD = 
0.27721) (t [121] = 3.330, p < 0.001). Additionally, the results of the analysis 
show that IT governance relational mechanisms (m = 1.9115, SD = 0.50717) 
and IT governance structures (m = 4.3415, SD = 0.38494) support IT 
governance initiatives much more than the latter two do (t [121] = 40.723, 
p = 0.0005). The results of the analysis show that there is much greater 
agreement that IT governance relational mechanisms (m = 1.9115, SD = 
0.50717) than IT governance processes (mM = 4.3648, SD = 0.27721) support 
IT governance initiatives (t [121] = 42.349, p = 0.0005). From the foregoing, 
it is clear that support is ranked from strongest to weakest in terms of IT 
governance structures, processes and relational mechanisms. An analysis 
of support across sectors reveals that the private sector’s IT governance 
relational mechanisms, structures and processes are supported in 
decreasing order of strength. Although IT governance structures and 
processes are not materially different in the public sector, they are both 
superior to relational mechanisms. The results on how private and public 
health care sectors are adopting IT governance were presented in the 
previous sections. The results on implementation barriers for IT governance 
are provided in the sections that follow. 


Information technology governance inhibitors 


Regarding the conceptual framework described in Chapter 2, an analysis 
was conducted. Through the lens of the TOE framework combined with the 
DOI theory, IT governance inhibitors are investigated. The three factors - 
technological context (IT governance context), organisational context and 
environmental context - that affect how an enterprise applies technological 
improvements were developed through the application of the DOI theory 
and the TOE theory. Finally, a comparison analysis is carried out to identify 
the barriers to IT governance across industries. 
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Information technology governance context 

inhibitors 
Results analysis shows that there is strong agreement that IT governance 
frameworks, standards and solutions are complicated and hinder the 
application of IT governance (m = 4.55, SD = 0.500, t [120] = 34.000, 
p = 0.0005). There is a great deal of agreement about how expensive and 
difficult IT governance is to execute as a barrier to adoption (m = 4.54, 
SD = 0.533, t [120] = 31.728, p = 0.0005). Additionally, there is strong 
agreement that IT governance is incompatible with current structures 
(m = 3.64, SD = 0.729, t [120] = 9.731, o = 0.0005) and that there are no 
tangible gains from IT governance (m = 4.06, SD = 0.537, t [120] = 21.672, 
p = 0.0005). 


Organisational context inhibitors 


Results indicate significant agreement on the majority of the factors 
resistant to change, including IT governance context inhibitors (m = 4.06, 
SD = 0.537, t [120] = 21.672, p = 0.0005), management’s lack of awareness 
of IT governance (m = 3.17, SD = 0.843, t [120] = 2.264, p = 0.025) 
(management’s lack of awareness of IT governance) and a lack of skills 
and knowledge about IT governance (m = 4.62, SD = 0.959). Budgetary 
and financial constraints (m = 4.90, SD = 0.300, t [120] = 69.665, 
p = 0.0005), staffing constraints (m = 4.78, SD = 0.524), IT 
structure constraints (m = 4.60, SD = 0.540), lack of IT governance 
prioritisation (m = 4.11, SD = 0.480), IT governance implementation time 
constraints (m = 4.83, SD = 0.380) and high effort requirement in 
implementation (m = 4.83, SD = 0.380). 


O External environment context inhibitors 


According to the findings analysis, there are many disputes over the 
existence of frameworks, standards and solutions for IT governance 
(m = 1.66, SD = 0.525, t [120] = -9.595, p = 0.0005). Additionally, there 
is a lack of support from the market structure and industry characteristics 
(m = 2.32, SD = 0.777, t [120] = -28.034, p = 0000.5), a lack of support 
from technology (m = 1.83, SD = 0.823), a lack of support from vendors 
(m = 1.59, SD = 0.715) and a lack of support from the regulatory 
environment (m = 1.77, SD = 0.783). Additionally, the results do not 
support the claims that business and IT professionals do not communicate 
well with one another or that political influence hinders IT governance. 
A cross-sector comparison of IT governance barriers is provided in the 
section below. 
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Information technology governance inhibitor 
comparative analysis 


Comparative analysis reveals that there is much more disagreement 
regarding the lack of IT governance frameworks, standards and solutions in 
the public sector (m = 1.81, SD = 0.450) than in the private sector (m = 1.58, 
SD = 0.547) (t [101.51] = -2.564, p = 0.012). Although the lack of a close link 
between IT and non-IT sectors is a hindrance to IT governance, there is 
much more agreement in the public sector (m = 3.56, SD = 0.590) than in 
the private sector (m = 3.18, SD = 0.528) (t [78.954] = -3.506, p = 0.001). 
Additionally, the findings reveal that there is much greater agreement in 
the public sector (m = 3.47, SD = 0.667) than in the private sector (m = 3.01, 
SD = 0.890) regarding the claim that management is unaware of IT 
governance (t [119] = -2.910, o = 0.004). Further analysis reveals that there 
is significantly greater agreement in the public sector (m = 4.79, SD = 0.412) 
than in the private sector (m = 4.53, SD = 0.659) regarding the fact that the 
implementation of IT governance is being hampered by a lack of knowledge 
and skills (t [117.067] = -2.718, p = 0.008). A lack of executive management 
buy-in is also shown to be hindering IT governance, with data showing 
that there is much more agreement in the public sector (m = 4.07, 
SD = 0.507) than in the private sector (m = 3.79, SD = 0.567) (t [119] = 
-2.649, p = 0.009). 


Further comparison analysis demonstrates that the public sector 
(m = 3.77, SD = 0.527) and the private sector (m = 3.51, SD = 0.698) are 
much more in agreement that the absence of institutional IT governance 
is a hindrance (t [107.564] = -2.259, p = 0.026). Results indicate that 
there is significantly greater agreement in the public sector (m = 3.37, 
SD = 0.578) than in the private sector (m = 2.90, SD = 0.695) regarding 
the issue of communication barriers between IT and business stakeholders 
as a barrier to the implementation of IT governance (t [119] = -3.809, 
p = 0.0005). The private sector (m = 2.22, SD = 0.784) exhibits more 
disagreement than the public sector (m = 2.51, SD = 0.736) about the 
significance of IT governance being severely hampered by a lack of 
support from industry features and the market structure (t [119] = -2.015, 
p = 0.046). There is much less agreement that a lack of technological 
support prevents the implementation of IT governance in the commercial 
sector (m = 1.64, SD = 0.720) than in the public sector (m = 157 2.16, 
SD = 0.898) (t [119] = -3.488, p = 0.001). 


In addition, there is much more dispute over whether a lack of vendor 
support is impeding the adoption of IT governance in the private sector 
(m = 1.42, SD = 0.547) than in the public sector (m = 1.88, SD = 0.879) 
(t [60.365] = -3.121, o = 0.003). The findings reveal that there is significantly 
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more disagreement in the private sector (m = 1.62, SD = 0.688) than in the 
public sector (m = 2.05, SD = 0.872) regarding the claim that the 
implementation of IT governance is being hampered by a lack of support 
from the regulatory environment (t [119] = -2.995, p = 0.003). According to 
the findings, political influence is substantially more widely agreed upon in 
the public sector (m = 4.19, SD = 0.824) than in the private sector (m = 2.01, 
SD = 0.860) (t [119] = -13.499, p = 0.0005). According to the findings, 
management is less concerned with IT governance and is impeding the 
implementation of IT governance in the public sector (m = 4.05, SD = 
0.434) than in the private sector (m = 3.73, SD = 0.678) (t [116.240] = -3.117, 
p = 0.002). Finally, comparison analysis shows that the business environment 
complexity is a substantial barrier to the implementation of IT governance 
in the public sector (m = 4.12, SD = 0.731) compared to the private sector 
(m = 3.56, SD = 0.862) (t [99.276] = -3.728, p = 0.0005). 


Comparative studies in the earlier sections show that there is more 
consensus regarding the existence of inhibitors in public health care than 
in private health care. To statistically establish the classification of IT 
governance inhibitors, an additional study was carried out. The findings 
are provided in the section below. The findings indicate that there are 
organisational IT governance inhibitors that are significantly present 
(m = 3.5041, SD = 0.40669, t [120] = 13.635, o = 0.0005) and that these 
are the elements preventing IT governance from occurring within the 
organisations. Results, however, show that there are no external 
environment-related IT governance inhibitors (m = 1.8760, SD = 0.58195, 
t [120] = -21.245, o = 0.0005). The findings unmistakably show that 
organisations have powerful pressures working against the application 
of IT governance. Additionally, group statistics using Levene’s test for 
equality of variance were used to assess the importance of inhibitors in 
various industries. The findings reveal that there is much greater agreement 
about the fact that organisational problems are impeding the adoption of 
IT governance in the public sector (m = 3.6977, SD = 0.32768) than in the 
private sector (m = 3.3974, SD = 0.40835) (t [119 = -4.140, 158, p = 0000.5). 
Additionally, the findings show that there is much more disagreement 
about external reasons impeding the implementation of IT governance 
in the private sector (m = 1.7244, SD = 0.32768) than in the public sector 
(m = 2.1512, SD = 0.40835) (t [67.101] = -3.757, o = 0.0005). Information 
technology governance barriers in both private and public health care 
sectors are shown in Figure 6.10. 


Overall results show that the public sector faces higher organisational 
and external barriers to IT governance than the private health care industry, 
which is more than predicted. Results on implementation barriers for IT 
governance in both private and public health care sectors were covered in 
the section before, and the sections that follow present results on the 
effectiveness of IT governance. 
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accommodate implementation of IT governance 
Difficulty in proving IT governance 
monetary value to management 


at the expense of IT governance 


Political interference 

High effort requirement in implementation 

IT governance implementation time constraints 
Lack of IT governance prioritisation 

IT structure constraints 

Staffing constraints 

Lack of regulatory environment support 
Lack of vendor support 


Lack of technology support 


Lack of support from industry characteristics 
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FIGURE 6.10: Information technology governance inhibitor frequencies. 
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Information technology governance performance 


Analysis of the data reveals that organisations are monitoring the 
effectiveness of their IT investments (m = 3.38, SD = 0.733, t [121] = 5.703, 
p = 0.0005). In both commercial and public health care, however, there is a 
large divide between how well IT satisfies organisational needs and 
expectations (m = 2.83, SD = 0.489, t [121] = -3.718, p = 0.0005). 


Additional one-sample t-tests on each industry separately demonstrate 
that private health care is monitoring IT investment performance (m = 3.72, 
SD = 0.556, t [77] = 11.406, p = 0.0005). It is not important for either 
organisation whether IT satisfies their needs or expectations. Contrarily, 
there is a lot of dispute over how public health care measures the 
effectiveness of its IT investments (m = 2.77, SD = 0.611, t [42] = -2.496, 
p = 0.017). Furthermore, there is a lot of disagreement about whether 
public health care IT meets the needs and expectations of the organisations 
(m = 2.49, SD = 0.592, t [42] = -160 5.662, o = 0.0005). As seen in the 
earlier sections, it is evident that IT initiatives in public health care are a 
long way from achieving their intended goals. 


Four domains made up of anticipated IT governance results, were 
determined during the qualitative phase. Improved health care service 
delivery, cost-effective IT use, administrative procedures and clinical 
research are the results of IT governance. The four domains were surveyed 
to determine their significance as consequences of IT governance and the 
role that IT governance played in their creation. The sections below include 
the results. 


Analysis of the data reveals strong consensus that improving clinical 
services delivery as an outcome of IT governance is crucial for the health 
care industry (m = 4.77, SD = 0.433, t [120] = 43.943, p = 0.0005). 
Additionally, the findings demonstrate strong consensus that the health 
care industry values improving cost-effective IT use as an outcome of IT 
governance (m = 4.21, SD = 0.604, t [120] = 21.960, p = 0.0005). Additionally, 
the findings demonstrate strong agreement that improving administrative 
procedures is a crucial IT governance outcome for the health care industry 
(m = 4.51, SD = 0.549, t [120] = 30.277, p = 0.0005). However, as the 
outcome was not significant, no inference regarding how to improve clinical 
research can be made. 


To find out how IT governance affected the realisation of its results, 
more study was done. The findings demonstrate strong agreement that 
improving clinical service delivery in the health care industry has been 
influenced by IT governance (m = 3.29, SD = 0.612, t [120] = 5.203, 
p = 0.0005). Results, however, demonstrate stark disagreement on the 
claim that IT governance has improved the cost-effective use of IT in the 
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health care industry (m = 2.59, SD = 0.654, t [120] = -6.949, p = 0.0005). 
Additionally, the findings demonstrate strong agreement that IT governance 
has contributed to improving administrative procedures in the health care 
industry (m = 3.40, SD = 0.598, t [120] = 7.293, p = 0.0005). The degree to 
which IT governance has improved clinical research in the health care 
industry is significantly disputed (m = 1.74, SD = 0.639, t [120] = -21.612, 
p = 0.0005). 


Results show that IT governance improved the provision of health care 
services and improved administrative procedures. However, there was no 
change in the efficient use of IT for clinical research in both private and 
public health care sectors. The results of the comparison analysis across 
sectors that were required as a result of the aforementioned findings are 
presented in the section below. The performance of IT governance across 
sectors is compared in the section that follows. 


Information technology governance performance 
comparative analysis 


Comparative study was carried out in order to come to comparative 
conclusions on the measurement of IT investment performance. According 
to comparative analysis across sectors, the private sector (m = 3.72, 
SD = 0.556) and the public sector (m = 2.77, SD = 0.611) had considerably 
higher levels of agreement regarding how well they are monitoring IT 
investment performance (t [119] = 8.689, p = 0.0005). Results also indicate 
that the private sector (m = 3.03, SD = 0.278) and the public sector 
(m = 2.49, SD = 0.592) have considerably higher levels of agreement 
regarding the extent to which IT meets organisational needs and 
expectations (t [52.389] = 5.616, o = 0.0005). 


Additionally, research on the outcomes of IT governance across sectors 
yields intriguing findings. Enhancing the cost-effective use of IT is crucial 
as a consequence of IT governance, and there is considerably more 
agreement in the private sector (m = 4.37, SD = 0.537) than in the public 
sector (m = 3.91, SD = 0.610) (t [119] = 4.339, p = 0.0005). However, there is 
disagreement in the public sector (m = 2.77, SD = 0.841) and agreement in 
the private sector (m = 3.35, SD = 0.850) about the significance of improving 
clinical research as an IT governance result (t [119] = 3.598, p = 0.0005). 


According to a comparative analysis, there is noticeably more 
agreement in the commercial sector (m = 3.49, SD = 0.575) than in the 
public sector (m = 2.93, SD = 0.507) that improved clinical care delivery 
has been influenced by IT governance (t [96.339] = 5.510, p = 0.0005). 
However, the findings indicate that there is significant disagreement 
regarding the impact of IT governance on the cost-effective use of IT for 
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both the commercial sector (m = 2.81, SD = 0.625) and the public sector 
(m = 219, SD = 0.500) (t [119] = 5.601, p = 0.0005). Further findings 
indicate that there is broad agreement that improved administrative 
procedures have been influenced by IT governance for both the 
commercial sector (m = 3.55, SD = 0.595) and the public sector (m = 3.12, 
SD = 0.498) (t [100.290] = 4.283, p = 0.0005). Finally, the findings 
reveal that there is significant disagreement regarding the impact of IT 
governance on improved clinical research for both the commercial sector 
(m = 1.87, SD = 0.611) and the public sector (m = 1.51, SD = 0.631) 
(t [119] = 3.068, p = 0.003). More than anticipated, the findings show that 
there is little consensus regarding how IT governance affects every IT 
governance outcome in the public health care sector. As a result, IT 
governance in public health care is ineffective. 


One-sample t-test results for each sector demonstrate a considerable 
degree of agreement that improved administrative procedures and clinical 
care delivery (m = 3.49, SD = 0.575, t [77] = 8.174, p = 0.0005, and m = 3.55, 
SD = 0.595, respectively) have benefited from IT governance in the private 
sector. Results, however, indicate that there is significant disagreement in the 
private sector regarding the impact of IT governance on improved clinical 
research (m = 1.87, SD = 0.611) and enhanced cost-effective use of IT (m = 2.81, 
SD = 0.625). As the results are not statistically significant, no conclusion can 
be drawn about improved clinical service delivery and improved administrative 
procedures in the public sector. However, there is considerable disagreement 
in the public sector on the impact of IT governance on improved clinical 
research (m = 1.51, SD = 0.631) and enhanced cost-effective use of IT (m = 2.19, 
SD = 0.500) (t [42] = -10.669, p = 0.0005). 


Results show that improved clinical care delivery and improved 
administrative processes were made possible thanks in part to IT governance 
in the private sector. The cost-effective use of IT for improved clinical 
research, however, is not being realised via IT governance. Similar findings 
are shown for the public sector, where 163 improved clinical research and 
cost-effective IT utilisation are still not realised in IT governance outcomes. 
Results of IT governance performance were reported in this section, and 
the section that follows offers some interesting correlations. 


Correlation analysis 


The frequency with which IT issues are mentioned on board agendas is 
significantly positively correlated with the frequency with which IT is used 
for routine business (r = 0.309, p = 0.001). The level of significance for 
correlation (2-tailed) is 0.01. The outcome shows that organisations talk 
about IT issues more frequently on board’s agendas the more dependent 
they are on IT as shown in Table 6.1. 
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TABLE 6.1: Correlation between information technology use and information technology on board 
agenda. 


1.5 Use IT for your 1.7 Frequently are IT issues included in your 
everyday business organisation’s meetings or board agenda 

Pearson’s correlation 1 0:5091 

Sig. (2-tailed) - 0.001 

n 122 122 

Pearson’s correlation 0.309% 1 

Sig. (2-tailed) 0.001 - 

n 122 122 


Source: Adapted from Mangundu (2017, p. 163). 
Key: IT, information technology; Sig., significance; **Correlation is significant at the 0.01 level (2-tailed). 


TABLE 6.2: Correlation between information technology issues on boards and business/information 
technology alignment. 


1.7 Frequently are IT issues included 1.8 Alignment between your 
in your organisation’s meetings or organisation’s IT strategy and 
board agenda business strategy 
Pearson’s correlation 1 0.354** 
Sig. (2-tailed) - 0.000 
n 122 122 
Pearson’s correlation 0.354** 1 
Sig. (2-tailed) 0.000 - 
n 122 122 


Source: Adapted from Mangundu (2017, p.164) 
Key: IT, information technology; Sig., significance; **Correlation is significant at the 0.01 level (2-tailed). 


Additionally, there is a strong positive association (r = 0.354, p = 0.0005) 
between the regularity with which IT issues are placed on board agendas 
and the alignment of an organisation’s IT strategy with its business plan, as 
shown in Table 6.2. Previous studies have shown that organisations use IT 
governance in order to integrate their business and IT strategies. Information 
technology concerns should be often discussed on board agendas in order 
to achieve alignment of IT strategy to business strategy. 


The measurement of IT investment performance and the significance of 
IT and its governance are significantly positively correlated (r = 0.268, 
p = 0.003), as shown in Table 6.3. The findings show that attempts to 
assess IT performance are undertaken when organisations view IT and its 
governance as critical to their operations. Additionally, there is a strong 
positive association (r = 0.227, p = 0.012) between the significance of IT, 
its governance and IT satisfying the needs and expectations of the 
organisations. 


Furthermore, Table 6.4 demonstrates a strong positive association 
(r = 0.215, p = 0.018) between the perceived benefits of IT governance and 
executive management support. If management does not see benefits 
from IT governance initiatives, they do not prioritise them. 
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IT governance implementation time restrictions and the complexity 
of frameworks, standards and solutions have a substantial positive 
association (r = 0.195, p = 0.032), as revealed in Table 6.5. The longer it 
takes to deconstruct IT governance frameworks for implementation, the 
more complex they are. 


TABLE 6.3: Correlation between importance of information technology and measurement of information 
technology performance. 


3.1 Importance of IT and its 5.1 Measuring of IT investments 
governance to your organisation performance 

Pearson’s correlation 1 0.268** 

Sig. (2-tailed) - 0.003 

n 122 121 

Pearson’s correlation 0.268** 1 

Sig. (2-tailed) 0.003 - 

n 121 121 


Source: Adapted from Mangundu (2017, p. 164). 
Key: IT, information technology; Sig., significance; **Correlation is significant at the 0.01 level (2-tailed). 


TABLE 6.4: Correlation between executive management buy-in and information technology governance 
perceived benefits. 


4.1.10 Lack of executive 4.1.5 Lack of perceived benefits 
management buy-in from IT governance 

Pearson’s correlation 1 0215% 

Sig. (2-tailed) - 0.018 

n 121 121 

Pearson’s correlation 0.215* 1 

Sig. (2-tailed) 0.018 - 

n 121 121 


Source: Adapted from Mangundu (2017, p. 165). 
Key: IT, information technology; Sig., significance; **Correlation is significant at the 0.01 level (2-tailed). 


TABLE 6.5: Correlation between framework complexity and implementation time constraints. 


4.1.2 IT governance frameworks/ 4.1.21 IT governance implementation 
standards/solutions are complex time constraints 

Pearson’s correlation îl 0195: 

Sig. (2-tailed) - 0.032 

n 121 121 

Pearson’s correlation 0.195* 1 

Sig. (2-tailed) 0.032 - 

n 121 121 


Source: Adapted from Mangundu (2017, p. 165). 
Key: IT, information technology; Sig., significance; **Correlation is significant at the 0.01 level (2-tailed). 
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E Discussion 


According to quantitative findings, organisational factors, which come 
from within the organisation, are the key drivers for IT governance. 
Relational mechanisms do not significantly help IT governance activities; 
instead, organisations implement IT governance through structures and 
processes. Organisations must deal with impediments to IT governance 
implementation, mostly from within the organisation and the external 
environment. But IT governance on its own does not present any obstacles. 


E Conclusion 


The quantitative results confirmed and helped to clarify a number of 
ambiguous findings from the qualitative phase. The chapter covered 
quantitative findings from data gathered from respondents’ completed 
questionnaires. In order to present a complete picture of the study 
outcomes as part of mixed-methods research, the following chapter covers 
integrated results. 
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E introduction 


The previous chapter provided the quantitative findings, which were helpful 
in addressing some of the issues that the qualitative findings were unable 
to definitively resolve. The integration of qualitative and quantitative 
findings in a single study was encouraged by the exploratory sequential 
mixed-methods research design. This chapter begins with a defence of the 
integrated results before moving on to a consideration of the unified 
outcomes. 


E Integrated results 


In order to suggest implementation solutions, the study sought to identify 
barriers to IT governance implementation. The case study exploratory 
sequential mixed-methods methodology was utilised to gather and analyse 
data in order to meet the objectives. The goal of the qualitative phase was 
to better understand the issue by drawing on the IT governance experiences 
of the interviewees. By using an online survey questionnaire, the quantitative 
phase extended the qualitative phase in order to provide a better 
understanding of the issues addressed in Phase 1. Although the qualitative 
results accurately captured the interviewees’ experiences with IT 
governance in their organisations, they were unable to fully explain the 
IT governance concerns raised by the study questions on their own. 
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By quantifying the severity and scope of the problems brought up in 
Phase 1in relation to the phenomenon under investigation, the quantitative 
phase helped provide a comprehensive picture. 


However, because of an unanticipated initial deficit in the agreement 
over the qualitative and quantitative data, there were very minor 
variances. This inspired the researcher to conduct additional qualitative 
analysis that would not have been examined otherwise in order to get 
definitive conclusions. In order to ascertain whether the research’s 
findings are connected with the principal participants’ experiences 
and so added more validity to the findings, informal follow-up 
telephonic and Skype conversations were held with them. The disparities 
might not have been discovered without a mixed-methods research 
strategy that attempted to combine the qualitative and quantitative 
phases’ findings. As a result, the strength of the mixed-methods research 
technique allowed for the creation of a comprehensive depiction of the 
barriers to IT governance. The sections that follow go over integrated 
outcomes. 


E information technology governance driver 
integrated results 


Participants in the qualitative narratives described the forces influencing 
IT governance as coming both from within and outside of the 
organisations. The quantitative data, however, did not clearly support 
these important conclusions from the qualitative study, which indicated 
that organisational and external factors were the main drivers. Although 
additional quantitative research using factor analysis demonstrated that 
external components were invalid, their removal did not significantly 
alter the conclusions of the drivers of IT governance in health care. In 
order to help clarify the frictional findings, the researcher enquired into 
the discrepancy through telephone conversations with important 
individuals. Participants emphasised that internal organisational 
pressures and imperatives undoubtedly influenced the establishment of 
IT governance. They clarified that ensuring the application of IT 
governance in health care has very little to do with the external 
environment, if anything. Results of integrated IT governance deployment 
are shown in the following section. 


E Information technology governance 
implementation integrated results 


Qualitative findings agreed with the literature in terms of how IT 
governance is being implemented by organisations. Although qualitative 
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studies show that IT governance is implemented through structures, 
processes and relational mechanisms, quantitative findings show that 
organisations now exclusively execute IT governance through structures 
and procedures. In the organisations under study, relational mechanisms 
are not included in IT governance projects. Participants made references 
to the fact that relational mechanisms are not given priority before 
structures and processes in IT governance efforts have been completed. 
The results of integrated IT governance inhibitors are provided in the 
following section. 


E Information technology governance 
inhibitor integrated results 


Qualitative findings showed that the external environment, organisations 
and IT governance as an innovation are all sources of IT governance 
obstacles. Although IT governance elements were not significant as IT 
governance constraining factors, quantitative results showed several 
surprises and differences. Follow-up conversations with participants were 
conducted in order to provide some resolution, giving the researcher the 
opportunity to further the explanation. Additional interviews confirmed 
and backed up the findings, which unmistakably show that in order to 
provide IT governance with some wiggle room, organisations must deal 
with internal organisational constituents. 


Additionally, contrary to what was previously stated in the qualitative 
portion of the study, inhibitors could not be statistically classified into 
managerial, people-oriented elements. The composite category that the 
inhibitors are solely organisational context factors was supported. 
The findings further demonstrated that there is no relationship 
between organisational and external barriers to the implementation of 
IT governance, demonstrating that organisations have high internal 
barriers to adoption, independent of the business context in which they 
operate. 


E Information technology governance 
performance integrated results 


The results in relation to IT governance performance show significant 
disparities among sectors. Despite the fact that IT governance 
performance is evaluated in private health care. Unfortunately, public 
health care does not assess IT governance, and it is obvious that IT is a 
long way from achieving public health care’s intended business goals. 
Additionally, private health care demonstrated a significant respect for 
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their desired IT governance results, as well as the impact IT governance 
has had on the results. Results, however, show that IT governance is not 
performing as anticipated. After this section has presented the combined 
results, the next section provides the revised framework based on the 
data analysis. 


E Refined theoretical framework 


Through statistical examination of the constructs under investigation, the 
study’s conceptual framework was found to be valid. Based on the 
responses of the study participants, correlation analysis helped to provide 
a determination of the links between the framework’s constructs. 


E Framework constructs reliability test 


The Cronbach’s alpha test was used to evaluate the reliability and 
acceptability of the framework constructs in order to refine the model. The 
constituent components that make up the structures were examined. The 
constructs of the framework were unaffected by the other components. 
Important test elements are displayed in Table 7.1. 


According to Cronbach, who states that acceptable reliability is 
between 0.6 and 0.8, Table 7.1 shows questionnaire items that were valid 
to measure the model constructs. The average score from all of the 
survey items was 0.7, which shows strong item dependability for the 
constructs. 


The improved framework shown in Figure 7.1 is made up of a number of 
elements that the data analysis supported. A positive correlation indicates 
a relationship between two constructs that are related to their agreement, 
while a negative correlation indicates a relationship between their 
disagreements. Correlations between various framework constructs are 
shown and discussed in the sections that follow. 


TABLE 7.1: Framework construct reliability. 


Construct Questions Cronbach’s alpha Reliability 
Organisational inhibitors aba) ele T OR ie 12 0.621 Good 
External inhibitors 4.1: 14; 15; 16; 17 0.741 Good 
Drivers 2161234 518 718 0.734 Good 
IT governance structures 3.7: 1;2;3;4;5;6;7;8;9 0.787 Good 
IT governance processes 38 1234:5678 910 0.711 Good 
IT governance relational mechanisms 3.9 : 3;4;5;6;7 0.693 Good 
IT governance outcomes importance Saa 0.642 Good 
IT governance outcomes influence 5.4 :1;2;3;4 0.721 Good 


Source: Adapted from Mangundu (2017, p. 170). 
Key: IT, information technology. 
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FIGURE 7.1: Final information technology governance implementation framework. 


E information technology governance drivers 
construct correlation results 


The relationship between IT governance frameworks and drivers is positively 
correlated, as shown by the Pearson’s correlation coefficient of 0.569 
between the two. Information technology governance frameworks are 
formed as long as there are IT governance drivers. The p-value is less than 
the significance level of 0.01 with a value of 0.01. According to the 
p-value, the association is significant. Additionally, there is a positive link 
between the variables, as seen by the Pearson’s correlation coefficient of 
0.583 between IT governance processes and drivers. Information 
technology governance processes are formed as a result of existing IT 
governance drivers. The p-value is less than the significance level of 0.01 
with a value of 0.01. According to the p-value, the association is significant. 
However, the p-value is higher than the significance threshold of 0.01 and is 
more than the Pearson’s correlation coefficient between IT governance 
drivers and relational mechanisms, which is -0.173. The correlation is not 
statistically significant, according to the p-value. 
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The framework illustrates the connection between agreement on the 
existence of IT governance drivers and agreement on the support for IT 
governance provided by IT governance procedures. The framework also 
shows a connection between agreement on the existence of IT governance 
drivers and agreement on the support provided by IT governance structures. 
The development of IT governance structures and processes that support 
IT governance activities are positively correlated with the drivers of IT 
governance. The framework, however, shows that the notion that there are 
IT governance drivers is unrelated to the relational support mechanisms for 
IT governance. 


Organisational inhibitors construct 
correlation results 


The relationship between organisational barriers and IT governance 
frameworks is inverse, as indicated by the Pearson’s correlation 
coefficient, which is -0.117. Organisational barriers are lessened as IT 
governance structures are built. The p-value is greater than the 
significance level of 0.01 at 0.202. The correlation is not statistically 
significant, according to the p-value. According to the updated 
framework, there is a correlation between the agreement that IT 
governance structures support IT governance and the disagreement 
that there are organisational barriers. The findings imply that the 
absence of organisational IT governance barriers occurs in the existence 
of IT governance frameworks. 


A negative link between the variables is also indicated by the Pearson’s 
correlation coefficient of -0.115 between organisational hindrances and IT 
governance procedures. Organisational barriers are diminished as IT 
governance mechanisms are developed. The significance criterion of 0.01 
is exceeded by the p-value of 0.292, which is higher. The correlation is not 
statistically significant, according to the p-value. According to the updated 
framework, there is a correlation between the agreement that IT 
governance processes support IT governance and the disagreement that 
there are organisational barriers. The findings imply that the absence of 
organisational IT governance barriers occurs in the existence of IT 
governance processes. 


The final statistic shows a negative association between the variables, 
with a Pearson’s correlation coefficient of -0.118 between organisational 
inhibitors and IT governance structures. Organisational barriers are lessened 
as relational tools for IT governance are built. The p-value is greater than 
the significance level of 0.01 at 0.201. The correlation is not statistically 
significant, according to the p-value. The improved approach shows that 
agreement that relational processes promote IT governance is connected 
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to disagreement that organisational bottlenecks exist. The findings imply 
that the absence of organisational IT governance inhibitors occurs in the 
presence of relational mechanisms for IT governance. 


Environmental inhibitors construct 
correlation results 


The association between external inhibitors and IT governance structures is 
inverse, with a Pearson’s correlation coefficient of -O.530. External 
impediments are lessened as IT governance structures are built. The p-value 
is less than the significance level of 0.01 with a value of 0.01. According to the 
p-value, the association is significant. The improved framework demonstrates 
a relationship between disputes over the existence of environmental 
inhibitors and agreement over the support provided by IT governance 
institutions for IT governance. Environmental context factors are minimised 
as IT governance frameworks are built up to assist IT governance. 


A negative correlation between the variables is indicated by a Pearson’s 
correlation coefficient of -0.500 between external inhibitors and IT 
governance processes. External impediments are lessened as IT governance 
practices are implemented. The p-value is less than the significance level of 
0.01 with a value of 0.01. According to the p-value, the association is 
significant. The improved framework demonstrates a relationship between 
disputes over the existence of environmental inhibitors and agreement 
over the support provided by IT governance processes for IT governance. 
Environmental context factors are minimised as IT governance processes 
are set up to assist IT governance. 


Additionally, a negative correlation between the variables may be seen 
in the Pearson correlation coefficient of -0.470 between external inhibitors 
and relational mechanisms of IT governance. External impediments are 
lessened as relational methods for IT governance are built. The p-value is 
less than the significance level of 0.01 with a value of 0.01. According to the 
p-value, the association is significant. The improved approach shows that 
agreement that relational processes enable IT governance is connected to 
disagreement that environmental inhibitors exist. Environmental context 
factors are diminished as relational mechanisms for IT governance are set 
up to support IT governance. Additionally, there is no connection between 
organisational and environmental barriers. 


Information technology governance structures 
construct correlation results 


The significance level of 0.01 is equal to the Pearson’s correlation coefficient 
of -0.292 between IT governance structures and the importance of IT 
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governance results. The p-value provides ambiguous evidence for the 
association between the relevance of IT governance results and IT 
governance architecture because it is near the significance level. 
Additionally, the p-value is below the significance threshold of 0.01, and the 
Pearson’s correlation coefficient between IT governance structures and IT 
governance outcomes influence is 0.529. According to the p-value, the 
association is significant. The framework highlights the relationship 
between the consensus that IT governance procedures support IT 
governance and the consensus that IT governance structures support IT 
governance. Additionally, the agreement that IT governance outcomes are 
significant is connected to the agreement that IT governance frameworks 
assist IT governance. The findings also imply that IT governance procedures 
are established and present as a result of IT governance structures in order 
to support IT governance. The findings also suggest that the significance 
given to IT governance outcomes influences how IT governance frameworks 
are established. 


Information technology governance processes 
construct correlation results 


The relevance of IT governance results and processes has a Pearson’s 
correlation coefficient of 0.182, and the p-value is 0.046, which is less than 
the 0.05 level of significance. According to the p-value, the association is 
significant. Additionally, the p-value is below the significance threshold of 
0.01, and the Pearson’s correlation coefficient between IT governance 
practices and outcomes influence is 0.490. According to the p-value, the 
association is significant. Additionally, agreement that the outcomes of IT 
governance are significant is connected to agreement that IT governance 
methods promote IT governance. It is connected to agreement that IT 
governance influences results that IT governance practices support IT 
governance. The findings imply that the significance given to IT governance 
outcomes has a direct impact on IT governance processes. The findings 
also suggest that the foundation of IT governance processes is based on 
their impact on governance outcomes. The findings are consistent with 
both quantitative and qualitative research in that IT governance methods 
are crucial to the success of both IT governance and outcome realisation. 


Information technology governance relational 
mechanisms construct correlation results 


The significance criterion of 0.01 is exceeded by the Pearson’s correlation 
coefficient of 0.082 between the relevance of IT governance results and 
relational mechanisms, which has a p-value of 0.369. The correlation is not 
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statistically significant, according to the p-value. Additionally, the p-value 
of 0.272 exceeds the significance threshold of 0.01, and the Pearson’s 
correlation coefficient between IT governance relationship mechanisms 
and IT governance outcomes influence is 0.101. The correlation is not 
statistically significant, according to the p-value. The concept provides no 
evidence that IT governance relational mechanisms are connected to both 
the relevance and influence of IT governance outcomes. The findings imply 
that relational mechanisms are not necessary for achieving the desired 
objectives of IT governance. At the same time, relational processes have no 
impact on the outcomes of IT governance. Relational mechanisms are 
higher-order processes as organisations set up IT governance. This is 
consistent with academic research and qualitative studies that showed 
how organisations build IT governance first through structures, then 
through procedures and last through relational mechanisms. 


As relationships are built on correlation results, correlation results show 
the relevance of the framework constructs. The correlations between the 
framework constructs were covered in this section. The diagrammatic form 
of the framework constructs is shown in Figure 7.1. 


A more detailed model of the explored constructions is shown in 
Figure 71. In the sections that came before the figure, the construct 
correlations were explained. 


E Discussion on framework 


The existence of IT governance drivers in organisations is supported by the 
IT governance drivers’ component. Organisational requirements do force 
organisations to think about and execute IT governance. The approach also 
accepts that environmental and organisational contexts play a role in the 
occurrence of inhibitors. However, the paradigm does not significantly 
provide context inhibitors for IT governance. The framework’s organisational 
context component makes the case that organisations must recognise and 
acknowledge the fact that substantial forces are working against the 
implementation of IT governance. The environmental context component 
also shows that there are external impediments to organisations. 


The IT governance implementation structures component promotes the 
creation of IT governance, positions in IT governance and committees that 
regularly monitor IT governance. Additionally, the methods used to 
implement IT governance promote the requirement for IT governance 
organisations to set up different processes. Relational procedures for IT 
governance, which are not a crucial component of an organisation’s 
pragmatic application of IT governance, are not supported by the 
framework. 
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In conclusion, the framework contends that barriers to IT governance 
implementation can take many different forms and originate both inside 
and outside of organisations. The adoption of IT governance is not difficult 
on its own. The methodology and results have the potential to improve the 
implementation of IT governance, which is now a difficult problem, and 
demystify the phenomenon around it. Instead of being scared by the 
alleged barriers to IT governance, organisations should focus their efforts 
on adapting to and preparing for the implementation process. 


E Results and framework validation 
interviews 


Interviews with some of the participants from the first sample were 
conducted to validate the results, utilising the strength of the mixed- 
methods design. The results and improved framework served as the basis 
for interview questions. The framework and results, which served as the 
foundation for the research’s major contribution - its conclusions and 
recommendations - were accepted by the interviewees. A description of 
the factors to be considered when presenting the integrated findings is 
provided in the section that follows. 


E Discussion 


The combined qualitative and quantitative study findings were discussed 
in this chapter. Disparities were also found, pointing to further contributions 
from the mixed-techniques strategy. The power of mixed methods to 
provide a reciprocal dialogue between qualitative and quantitative data is 
thus proved, as findings from one phase inform the migration to the next, 
enabling a refinement of the next stage of the inquiry. In this study, 
quantitative measurements were advanced using qualitative findings. 
However, a more thorough application of mixed methods might make use 
of the divergent results to refine the data collection instrument based on 
the effort to reconcile the results, even if it would not be feasible given the 
financial restrictions and timescale for the current project. It is probable 
that the results were impacted by the outcomes of the one-year delay 
between the gathering of qualitative and quantitative data. The validity of 
the results, which would have been overlooked in the absence of a mixed- 
methods approach, was further illuminated by further interviews to learn 
from the participants whether the study findings resonate with their 
experience. 
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E Conclusion 


In order to address the study topics, integrated quantitative and qualitative 
results presented a comprehensive picture. The next chapter offers a 
thorough discussion, conclusions drawn from the conversations and the 
study’s suggestions. 
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Conclusions and 
recommendations 


E introduction 


This final chapter discusses the conclusions drawn from the analysed data 
that attempted to answer the research questions while addressing the 
problem statement. To aid organisations in facilitating IT governance 
adoption, the study’s objectives included evaluating implementation barriers. 
The literature analysis in Chapter 3 showed that corporate organisations are 
having difficulty implementing well-designed IT governance frameworks, 
standards and solutions. The literature also demonstrated a dearth of 
research on the causes of poor adoption rates, particularly when it comes to 
developing nations like South Africa, which gave rise to this study’s goals. 
The research was required to offer responses to the main research question 
and the sub-questions to accomplish the goals. 


In Chapter 4, a mixed-methods approach was used to conduct the 
research using interviews, the gathering and analysis of documents, and an 
online survey from the private and public health care organisations under 
study. Data were largely gathered from IT and business decision-makers 
through semi-structured interviews and the survey questionnaire, while 
secondary data were obtained through document analysis. Phase 1 of the 
investigation was reported in Chapter 5 as the qualitative findings. Using 
the theoretical framework offered in Chapter 2 as a guide, quantitative 
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study findings were presented and described in Chapter 6. According to 
the research paradigm offered, many IT governance drivers, IT governance 
implementation mechanisms and IT governance implementation inhibitors 
were discovered and explored. The results from Chapters 5 and 6 were 
combined in Chapter 7 and reviewed in Chapter 8, where insightful 
information was found that can help organisations implement their IT 
governance. The chapter also contributes to the corpus of knowledge 
regarding IT governance. Additionally, Chapter 8 offers suggestions for 
those working in organisations implementing IT governance, as well as the 
implications for researchers and some ideas for future research projects. 


This book adds to the continuing debate over factors that prevent the 
implementation of IT governance in underdeveloped nations. Some of the 
conclusions from the literature review were validated by the empirical data. 
While the literature partially addressed some of the study questions, 
empirical evidence analysis was able to provide a clear picture of how and 
why things were the way they were by identifying some of the emergent 
determinants. The research is complete as a consequence of the analysis of 
empirical data. The primary contribution of the study was to identify and 
validate the barriers to IT governance activities to assist organisations in 
implementing IT governance. The study of inhibitors is essential because, 
once they are recognised, their effects can be understood and remedied. 
A ‘lubrication to the IT governance vehicle’ is made easier before, during 
and after implementation when IT governance inhibitors are understood. 
After a thorough analysis of the literature, the inhibitors were identified 
and, using a case study methodology, validated through interviews and the 
survey questionnaire with IT and business decision-makers in private and 
public health care. 


The survey also revealed that managerial in nature, people-, stakeholder- 
and organisation-oriented IT governance obstacles are internal to 
organisations. The recognised IT governance impediments serve as a mirror 
for organisations to examine themselves in order to address them and give 
a boost to the adoption of IT governance innovation. Companies 
implementing IT governance should evaluate their goals and resources. 
Stakeholder expectations that are holistic help everyone understand where 
the organisation wants to go. One of the main obstacles to its execution is 
the divergent stakeholder expectations and understandings of IT 
governance. Therefore, the study advises that before beginning IT 
governance activities, it is necessary to have a comprehensive grasp of the 
IT governance problem and its context. The study’s findings suggest that 
implementing IT governance requires a range of resources, from financial 
and human resources to labour and time requirements. Executive 
management and board support and oversight are essential to properly 
support IT governance initiatives because IT is not the main business. 
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The report also notes that businesses should not try to fully implement 
IT governance. However, the capabilities, expectations and risks to be 
minimised of the organisations should be used to establish the maturity 
stages of IT governance. Different IT governance implementation strategies 
and maturity levels are required for various organisational environments. 
Organisations can start IT governance activities and reap the expected 
advantages when they recognise that the problem context is crucial in 
establishing the scope of those initiatives. The next section evaluates how 
well the study addressed the research questions. 


E Answering the research questions 


The degree to which the sub-questions were addressed affected the 
response to the main research topic. Before offering answers to the primary 
topic, this section describes how the study addressed related questions. 


What are the drivers of information technology 
governance in private and public health care? 


The literature review provided a partial response to the research question 
on IT drivers. The necessity for new or updated IT governance policies was 
underlined in Chapter 2 because organisations are driven by both external 
and internal forces that manifest as trigger events and pain points. The 
research reaffirmed that there is no set reason why organisations should 
implement IT governance; rather, the motivations depend on the 
organisational environment. The Chapter 5 example that some of the forces 
propelling the private organisations were not seen inthe public organisations 
helped to make the argument. In Chapter 6, the major forces affecting IT 
governance in health care were measured to identify them. These internal 
organisational drivers for IT governance encourage organisations to think 
about implementing it. 


How are private and public health care sectors 
implementing information technology governance? 


Chapter 2 of the study’s literature review, which focused on how 
organisations execute IT governance through a combination of structures, 
procedures and relational mechanisms, provided some insight into the 
second topic. Both the qualitative and quantitative findings confirmed the 
point. However, the findings show that relational mechanisms are largely 
ignored as organisations implement IT governance through structures and 
processes. Quantitative findings in Chapter 6 served as both confirmation 
and reinforcement. 
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What are the inhibitors of information 
technology governance implementation in 
private and public health care sectors? 


To understand the difficulties of adopting IT governance in organisations, 
it was essential to read Chapter 2 in its entirety. According to the literature, 
the inhibitors were managerial and people-focused. The issues go beyond 
this, according to empirical data, and involve organisational capacities and 
outside variables. However, the key environmental context elements are 
the inhibitors. 


How is information technology governance 
performing in private and public health care 
sectors? 


Chapter 2 of the study addressed this question by reviewing the research 
on the efficiency of IT governance. The importance of IT governance results 
and their impact on performance are both crucial elements, according to 
the research. It is difficult to offer a thorough evaluation of IT governance’s 
performance, nevertheless, because health care organisations are still in 
the early stages of implementation. 


E Main and secondary objective fulfilment 


This section aims to demonstrate how well the study’s goals were achieved. 
The study’s primary goals were to identify the barriers to IT governance 
implementation and to offer suggestions for helping organisations with IT 
governance. Based on a thorough literature assessment, Chapter 2 more 
successfully accomplished these goals. Additionally, the inhibitors were 
verified by gathering and analysis of empirical data from troubled 
organisations. Before achieving the primary purpose, the subsidiary 
objectives were covered in this section. 


To determine the drivers of information 
technology governance in South African private 
and public health care sectors 
Through the literature review in Chapter 2, qualitative findings from 
interviews with IT and business decision-makers, and findings from 
document analysis in Chapter 5, the study was able to accomplish this goal. 


Quantitative data from Chapter 6 provided credibility in reaching the 
research goal. An in-depth understanding of the motivations for IT 
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governance implementation in organisations was strengthened by data 
analysis from various sources. The qualitative findings made it easier to 
understand what participants had to say about the driving forces behind IT 
governance in their companies. 


To determine information technology governance 

practices being implemented by South African 

private and public health care sectors 
The study achieved this goal through the literature review in Chapter 2, 
which revealed that a combination of relational mechanisms, structures 
and processes is used to implement IT governance. Qualitative and 
quantitative findings showed that while relational mechanisms are 
somewhat taken into account, organisations are adopting IT governance 
through structures and processes. 


To establish the inhibiting factors in the 
successful implementation of information 
technology governance in private and public 
health care sectors in South Africa 
The study’s primary goal was to identify and eliminate elements that 
hinder the adoption of IT governance. After a thorough literature analysis, 
Chapter 2 partially achieved the goal. Through data-gathering and analysis 


from IT and business decision-makers in the private and public health care 
sectors, Chapters 5 and 6 further strengthened the goal. 


To determine information technology governance 
performance in South African private and public 
health care sectors 
By analysing the data in Chapters 5 and 6, this goal was fully attained. 
However, how the phenomenon of IT governance performance is viewed 


was informed by the literature review. The next parts go into how the study 
achieved its major goal. 


E Reflections from the research 


Previous studies make reference to the challenges of gaining access to 
organisations, their collaboration and approval from gatekeepers for the 
collecting of empirical data. In this study, similar problems arose to the 
point where the research technique had to be revisited and changed in 
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order to meet the requirements for ethical approval. Only one of the study’s 
initial six eligible participants - six private health care organisations - 
accepted to take part. The study organisations were limited to two as a 
result of the participation of just one of the five provincial departments of 
health that were approached. The roles that the participants occupied 
made it difficult to acquire time with them. Cooperation was nevertheless 
welcomed. Additionally, combining the methodologies required a lot of 
time and effort in terms of writing reports and conducting fieldwork. 
However, the researcher stayed on course by working every day. The 
research contributions to the body of knowledge are shown in the section 
that follows. 


Research contributions 


In addition to adding to information and understanding, the research 
also advances theory and theory development, practice and application. 
A discussion of the scientific contributions is given in the sections that 
follow. 


O Contribution to knowledge and understanding 


The study provides a contribution to the field of IT governance in several 
ways. With few studies concentrating on the IT governance phenomenon 
from a developing country perspective, this study therefore makes a 
contribution by addressing the knowledge gap in such an important 
emerging area. The study made contributions through presentations at 
local research conferences. 


O Contribution to theory and theory development 


The study contributed fresh understandings to theories in the area of IT 
governance that were not before mentioned in the literature. These 
observations are especially relevant to the issues of IT governance 
implementation and obstacles to IT governance. Despite the fact that 
structures, processes and relational mechanisms are used, the study helped 
with how IT governance is executed. Pragmatism that is guided by 
organisational expectations and capabilities is used in implementation. The 
study also showed that the DOI and TOE models are useful conceptual 
frameworks for researching the difficulties of implementing an innovative 
IT governance system. Most importantly, by creating and putting forth a 
research model, the study added to the current conversation on IT 
governance with regard to implementation. Future academics studying IT 
governance may use the model and test its hypotheses by using its 
constructs. 
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O Contribution to practice and application 


In order to help organisations facilitate IT governance implementation and 
reap the benefits of IT decisions, the research helped practitioners of IT 
governance by resolving problems preventing its implementation. In 
addition, suggestions are given based on the study’s findings. It is clear 
from this that the study adds to both theory and practice in the field of IT 
governance. The restrictions placed on the research are covered in the 
following sections. 


©) Scholarship from the research 


The report offers helpful information on how IT governance is implemented 
in various ways in organisations. Some of the pertinent insights concerning 
IT governance that were gleaned from the current research were not 
included in the body of knowledge or literature that already existed. 


Even though it can be done by using identical IT governance frameworks, 
the first thing that needs to be understood is that IT governance is 
context-based. For the frameworks to match organisational expectations 
and capabilities, customisation is required. Without considering the 
organisational capabilities and expectations, the ambition to completely 
adopt an IT governance framework leads to a complete stoppage of the 
implementation process. Information technology governance frameworks 
donot offer implementation tactics or prioritisation categories. Prioritisation 
should be used in the implementation phase, with the organisation putting 
the most crucial controls in place first to address the most crucial business 
environment risks. This study also shows that organisational and internal 
context variables are the key obstacles to IT governance. As they begin to 
implement IT governance, organisations must address their expectations 
and capabilities. The survey also shows that organisations may easily carry 
out their IT governance activities with the help of a pragmatic strategy. 


E Research limitations 


Even though the research made several contributions to the body of 
knowledge regarding IT governance, limitations must be acknowledged. 
First, the research’s scope and methods must work within certain bounds. 
According to research ethics, the researcher must obtain written informed 
consent from all the study’s participants and target organisations. The 
number of organisations included in the study was constrained by ethical 
issues and the sourcing of gatekeeper and research participant consent. 
The researcher had to morally accept the positions taken by some private 
health care groups of hospitals who declared they were not able to 
participate in the study. Additionally, not all the organisations that may 
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participate in the study have reached the point where IT governance can 
be measured. This made it difficult to respond fully to the research question 
about the effectiveness of IT governance. 


The research’s conclusions are generalisable because it concentrated 
ona single provincial health department and a few hospitals, as well as a 
single private health care organisation and a few particular hospitals 
within the organisation. To strengthen the generalisability of the findings, 
the same study might be conducted in South Africa on more private 
health care organisations and provincial health agencies. The 
generalisation of the results could be improved with a survey of hospitals 
throughout South Africa and a quantification of the findings. Additionally, 
the study’s shortcomings include the fact that its participants were 
decision-makers in business and IT who held strategic positions. These 
individuals are under strain from organisational matters, which 
occasionally make it impossible for them to be available for involvement. 
Finding and soliciting feedback from those second in line of authority 
was the solution, even though their opinions might not accurately mirror 
those of the initially intended respondents. Despite these constraints, 
the researcher used mixed-research methodologies that strictly followed 
the prescribed research methods and used triangulation to increase the 
credibility of the findings. 


E Recommendations for future research 


Future research in IT governance can be well founded on the aforementioned 
restrictions. Action research could be used in future studies to learn more 
about how IT governance is implemented over time. To fully analyse the 
phenomenon, the researcher would need to be fully involved. The study’s 
primary focus was on South African private and public health care providers 
from one province and one private health care group of institutions, placing 
restrictions on how broadly the findings might be applied. However, the 
findings and recommendations from this study might also be applicable in 
other circumstances, particularly in underdeveloped nations. This study 
was exploratory and relied on case organisations, too. 


The variables discovered might be subjected to hypothesis testing in a 
study with a broad scope that would span many provinces and private 
hospital groups. Future studies could be accommodated by organisations 
that have begun to think about IT governance, allowing for the testing of 
variables in a wider context. Additionally, identified structures might be 
statistically re-evaluated to eliminate the most important barriers to the 
implementation of IT governance in the health care industry. Organisations 
would be aware and able to address the inhibitors based on the results if 
they were ranked. 
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This study found that IT governance inhibitors are multi-staged, with 
different sets of inhibitors being seen at various phases of deployment. In 
order to build on these findings, future studies might focus on re-evaluating 
IT governance barriers at different implementation phases. Through 
quantitative measurements and assumptions, the research model that was 
created may potentially be examined in various contexts. This study has 
significantly advanced the field of IT governance, particularly in the health 
care industry in a developing nation. Based on empirical findings, the 
following section offers advice for IT and IT governance practitioners in 
organisations. 


E Recommendations for information 
technology governance practitioners 


The study’s findings can be used to support several suggestions: 


1. Before beginning IT governance activities, the report advises that 
organisations and practitioners understand the problem situations. As 
they would concentrate on the most crucial implementations in line with 
their organisations, having knowledge of the organisation’s position and 
demands reduces the complexity of the IT governance implementation 
process. Additionally, IT governance innovations do not introduce 
barriers to IT governance. 

2. The report suggests implementing IT governance in a practical, realistic 
manner. When it comes to IT governance, there is no ‘one-size-fits-all’ 
solution because every context is unique. Therefore, organisations 
should evaluate and choose the best controls for their needs rather than 
focusing primarily on IT governance maturity. Organisations can promote 
IT governance more easily thanks to pragmatism’s reduction of 
complexity and associated expenses. 

3. Conflict between stakeholders about the intended governance maturity 
environment has been identified as one of the implementation barriers. 
The study suggests that stakeholders should, from the start, reach a 
consensus regarding the desired level of control maturity. For IT 
governance teams and other stakeholders to go in the same direction 
and accomplish a shared goal, information describing the intended state 
in terms of IT governance should be effectively communicated. 

4. The study also suggests marketing and communication of IT governance 
within organisations. Stakeholders can understand expectations, the 
advantages of IT governance and what needs to be done through 
communication. One of the main barriers to IT governance, opposition 
to change, is addressed through communication. In these situations, the 
organisation carries out the implementation efforts for IT governance 
like a ‘well-oiled machine’. 
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5. The report advises organisations using IT governance to create a 
supportive environment by changing the culture. One of the factors 
most frequently cited as impeding IT governance is culture. Ownership 
of IT governance projects is made easier by a favourable culture. 

6. The study also suggests that IT governance be supported from the top 
down. Results showed that IT governance increases the workload placed 
on employees’ daily responsibilities. When it is supported from the top, 
the individuals concerned have no choice but to seriously consider the 
plans and encourage their execution. 

7. The support and cooperation of all the relevant stakeholders are essential 
for improving the execution of IT governance. Everybody who is involved 
becomes a customer of IT governance as a service. The promotion of 
ownership and accountability for IT governance activities is necessary. 

8. The study’s findings also showed that depending on the level of 
implementation, organisational context variables are the biggest 
obstacles to the adoption of IT governance. Organisations must realise 
that there are many different types of barriers to the implementation of 
IT governance. Before, during and after the deployment of IT governance, 
the identified impediments must be resolved by the organisations as a 
continuous process. The potential for future study on IT governance is 
presented in the final section. 


E Concluding annotations 


The main takeaways from the research on IT governance implementation in 
organisations are highlighted in this section. The implementation-related 
barriers are given special consideration. As a result, the study emphasises 
how important it is to understand an organisation’s needs, position and 
features in connection to its goals. An organisation can start the process of 
implementing IT governance with a high level of success if it has a strong 
sense of self. As IT governance is context-based, choosing the optimum 
implementation mix for it is made easier with self-awareness in addition to 
strategy. Along with minimising the challenges, self-understanding also 
enables simple problem-solving while attempting to establish IT governance. 
The analysis showed that the best course of action for implementing IT 
governance is a practical, realistic approach. Organisations make IT 
governance complex by failing to execute it in a practical way. According 
to reports, IT governance has enormous requirements, and if organisations 
do not prioritise according to their requirements and capabilities, 
implementing it will be impossible. 


The study also showed that there are various types of IT governance 
inhibitors and that these inhibitors vary depending on how well organisations 
have implemented IT governance. As a result of the involvement of many 
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stakeholders at various phases of the implementation, this has been 
reported. As a means of achieving similar objectives and facilitating easy 
implementation processes, the inclusion of stakeholders, open 
communication, consultation and agreement from the outset has been 
highlighted. Conflicting expectations hinder implementation efforts and 
make implementing IT governance even more difficult. 


Organisations must understand that IT governance is context-based, 
which is the final and most crucial point. Adopting tested solutions from 
another organisation without considering whether they apply to the 
organisation in question results in implementation barriers. Based on 
prioritisation and the needs of the organisation, the desired maturity level 
for IT governance should be customised. Additionally, the adoption of IT 
governance is a dynamic process that evolves along with changing business 
needs and capabilities. Without taking these elements into account, 
organisations risk having a number of issues that obstruct their IT 
governance initiatives. It is anticipated that the conclusions and suggestions 
will make IT governance adoption in organisations easier. 


E Ending remark 


Based on the expectations and resources of the organisation, there are 
organisationally specific IT governance inhibitors. In that sense, 
organisations can get over the barriers by evaluating their expectations 
and capabilities and then moving forward with the implementation of IT 
governance while adopting a practical mindset. 


167 


References 


AbukKhousa, E & Al-Qirim, N 2012, ‘Health information technology governance: A perspective 
on investment decision processes’, Proceedings of the 23rd Australasian Conference on 
Information Systems, ACIS, Geelong, 03-05 December, pp. 1-11. 


Agerfalk, PJ 2010, ‘Getting pragmatic’, European Journal of Information Systems, vol. 19, no. 3, 
pp. 251-256. https://doi.org/10.1057/ejis.2010.22 


Agerfalk, PJ 2013, ‘Embracing diversity through mixed methods research’, European Journal 
of Information Systems, vol. 22, no. 3, pp. 251-256. https://doi.org/10.1057/ejis.2013.6 


Alshenqeeti, H 2014, ‘Interviewing as a data collection method: A critical review’, English 
Linguistics Research, vol. 3, no. 1, pp. 39-45. https://doi.org/10.5430/elr.v3nlp39 


Baker, J 2012, ‘The technology-organization-environment framework’, in YK Dwivedi, 
MR Wade & SL Schneberger (eds.), Information systems theory: Explaining and predicting 
our digital society, vol. 1, University of Hamburg, Hamburg, pp. 231-245. 


Baker, S & Edwards, R 2017, How many qualitative interviews is enough? Expert voices and 
early career reflections on sampling and cases in qualitative research, National Centre for 
Research Methods, Southampton. 


Basaglia, S, Caporarello, L, Magni, M & Pennarola, F 2009, ‘Environmental and organizational 
drivers influencing the adoption of VoIP’, Information Systems and E-Business Management, 
vol. 7, pp. 103-118. https://doi.org/10.1007/s10257-008-0077-1 


Benamati, J & Lederer, AL 2001, ‘Rapid information technology change, coping mechanisms, 
and the emerging technologies group’, Journal of Management Information Systems, 
vol. 17, no. 4, pp. 183-202. https://doi.org/10.1080/07421222.2001.11045663 


Bernanda, DY & Michelle, A 2021, ‘Evaluation and recommendation IT governance based 
on COBIT 5 framework in Harris Vertu Harmoni Hotel’, /nternational Journal of Open 
Information Technologies, vol. 9, no. 1, pp. 86-94. 


Bhattacharjya, J & Chang, V 2009, ‘Adoption and implementation of IT governance: Cases 
from Australian Higher Education’, in Information technology governance and service 
management: Frameworks and adaptations, IGI Global, Pennsylvania, pp. 82-100. 


Bird, DK 2009, ‘The use of questionnaires for acquiring information on public perception of 
natural hazards and risk mitigation - A review of current knowledge and practice’, Natural 
Hazards and Earth System Sciences, vol. 9, no. 4, pp. 1307-1325. https://doi.org/10.5194/ 
nhess-9-1307-2009 


Blaikie, N 2007, Approaches to social enquiry: Advancing knowledge, Polity, Cambridge. 
Bloem, J, Van Doorn, M & Mittal, P 2005, Making IT governance work in a Sarbanes-Oxley 
world, John Wiley & Sons, Hoboken. 


Bose, R & Luo, X 2011, ‘Integrative framework for assessing firms’ potential to undertake 
Green IT initiatives via virtualization - A theoretical perspective’, The Journal of Strategic 
Information Systems, vol. 20, no. 1, pp. 38-54. https://doi.org/10.1016/j.jsis.2011.01.003 


Bowen, PL, Cheung, MYD & Rohde, FH 2007, ‘Enhancing IT governance practices: A model and 
case study of an organization’s efforts’, /nternational Journal of Accounting Information 
Systems, vol. 8, no. 3, pp. 191-221. https://doi.org/10.1016/j.accinf.2007.07.002 


Boyatzis, RE 1998, Transforming qualitative information: Thematic analysis and code 
develooment, SAGE Publications, Thousand Oaks. 

Braun, V & Clarke, V 2012, Thematic analysis, American Psychological Association, Washington 
DC. 


Brown, AE & Grant, GG 2005, ‘Framing the frameworks: A review of IT governance research’, 
Communications of the Association for Information Systems, vol. 15, no. 1, p. 38. https://doi. 
org/10.17705/1cais.01538 


169 


References 


Campbell, J, McDonald, C & Sethibe, T 2010, ‘Public and private sector IT governance: 
Identifying contextual differences’, Australasian Journal of Information Systems, vol. 16, 
no. 2, pp. 5-18. https://doi.org/10.3127/ajis.v16i2.538 


Cavaye, AL 1996, ‘Case study research: A multi-faceted research approach for IS’, Information 
Systems Journal, vol. 6, no. 3, pp. 227-242. https://doi.org/10.1111/j.1365-2575.1996.tbOO015.x 


Cenfetelli, RT 2004, ‘Inhibitors and enablers as dual factor concepts in technology usage’, 
Journal of the Association for Information Systems, vol. 5, no. 11, p. 16. https://doi. 
org/10.17705/\jais.00059 


Chitambala, G 2010, ‘Status of IT governance in South Africa: A comparative view’, PhD thesis, 
University of Pretoria, Pretoria. 


Coates, A 2021, ‘The prevalence of philosophical assumptions described in mixed methods 
research in education’, Journal of Mixed Methods Research, vol. 15, no. 2, pp. 171-189. 
https://doi.org/10.1177/1558689820958210 


Cohen, L, Manion, L & Morrison, K 2007, Research method in education, 6th edn., Routledge, 
London. 


Cohen, L, Manion, L & Morrison, K 2017, ‘Approaches to qualitative data analysis’, in Research 
methods in education, Routledge, London, pp. 643-656. 


Cooper, DD & Schindler, PS 2001, Business research methods, 7th edn., Mcgraw-Hill, Boston. 


Cooper, RB & Zmud, RW 1990, ‘Information technology implementation research: A 
technological diffusion approach’, Management Science, vol. 36, no. 2, pp. 123-139. https:// 
doi.org/10.1287/mnsc.36.2.123 


Crabtree, BF & Miller, WL 2022, Doing qualitative research, SAGE Publications, Thousand 
Oaks. 


Creswell, JW 2009, ‘Mapping the field of mixed methods research’, Journal of mixed method's 
research, vol. 3, no. 2, pp. 95-108. 


Creswell, JW 2011, ‘Controversies in mixed methods research’, in NK Denzim & YS Lincoln 
(ed.), The Sage handbook of qualitative research, SAGE Publications, Thousand Oaks, 
pp. 269-284. 


Creswell, JW 2012, Educational research: Planning, conducting and evaluating quantitative 
and qualitative research, 4th edn., Pearson, Boston. 


Creswell, JW 2014, Research design qualitative, quantitative, and mixed methods approaches, 
Ath edn., SAGE Publications, Thousand Oaks. 


Creswell, JW 2015, ‘Revisiting mixed methods and advancing scientific practices’, in SN Hesse- 
Biber & RB Johnson (eds.), The Oxford handbook of multimethod and mixed methods research 
inquiry, Oxford Academic, Oxford. https://doi.org/10.1093/oxfordhb/9780199933624.013.39 

Creswell, JW 2019, Research design: Qualitative, quantitative, and mixed methods approaches, 
SAGE Publications, London. 

Creswell, JW 2021, A concise introduction to mixed methods research, SAGE Publications, 
Thousand Oaks. 

Creswell, JW & Clark, VLP 2011, Designing and conducting mixed methods research, SAGE 
Publications, Thousand Oaks. 

Creswell, JW & Clark, VLP 2017, Designing and conducting mixed methods research, SAGE 
Publications, Los Angeles. 

Creswell, JW, Klassen, AC, Plano Clark, VL & Smith, KC 2011, ‘Best practices for mixed methods 
research in the health sciences’, Bethesda (Maryland): National Institutes of Health, 
vol. 2013, pp. 541-545. 

Crotty, MJ 1998, The foundations of social research: Meaning and perspective in the research 
process, The Foundations of Social Research, London, pp. 1-256. 

Daly, J, Willis, K, Small, R, Green, J, Welch, N, Kealy, M & Hughes, E 2007, ‘A hierarchy of 
evidence for assessing qualitative health research’, Journal of Clinical Epidemiology, 
vol. 60, no. 1, pp. 43-49. https://doi.org/10.1016/j.jclinepi.2006.03.014 


170 


References 


Damanpour, F & Evan, WM 1984, ‘Organizational innovation and performance: The problem of 
“organizational lag”, Administrative Science Quarterly, vol. 29, no. 3, pp. 392-409. https:// 
doi.org/10.2307/2393031 


Darke, P, Shanks, G & Broadbent, M 1998, ‘Successfully completing case study research: 
Combining rigour, relevance and pragmatism’, /nformation Systems Journal, vol. 8, no. 4, 
pp. 273-289. https://doi.org/10.1046/j.1365-2575.1998.00040.x 


De Haes, S & Van Grembergen, W 2006a, ‘Information technology governance best practices 
in Belgian organisations’, Proceedings of the 39th Annual Hawaii International Conference 
on System Sciences (HICSS’06), Big Island, HI, United States of America, January, p. 195b. 


De Haes, S & Van Grembergen, W 2006b, ‘IT governance structures, processes and relational 
mechanisms: Achieving |T/business alignment in a major Belgian financial group’, 
Proceedings of the 38th Annual Hawaii International Conference on System Sciences, IEEE, 
Big Island, HI, United States of America, January, p. 237b. 


De Haes, S & Van Grembergen, W 2009, ‘An exploratory study into IT governance 
implementations and its impact on business/IT alignment’, /nformation Systems 
Management, vol. 26 no. 2, pp. 123-137. https://doi.org/10.1080/10580530902794786 


De Haes, S & Van Grembergen, W 2015, Enterprise governance of IT, Springer, Cham, pp. 11-43. 


De Haes, S, Van Grembergen, W, Joshi, A, Huygh, T, De Haes, S, Van Grembergen, W, Joshi, A & 
Huygh, T 2020, ‘Enterprise governance of IT, alignment, and value’, in Enterprise Governance 
of Information Technology: Achieving Alignment and Value in Digital Organizations, 
Springer Nature, Cham, pp. 1-13. 


Denzin, NK & Lincoln, YS (eds.) 2011, The Sage handbook of qualitative research, SAGE 
Publications, Vancouver. 


Department of Health 2012, National eHealth Strategy South Africa 2012-2016, viewed O9 August 
2018, <https://www.isfteh.org/files/media/southafrica_ehealth_strategy_2012-2016.pdf> 


Department of Health 2019, National digital health strategy for South Africa 2019-2024, 
viewed 10 February 2023, <https://www.health.gov.za/wp-content/uploads/2020/11/ 
national-digital-strategy-for-south-africa-2019-2024-b.pdf> 


Devaraj, S & Kohli, R 2003, ‘Performance impacts of information technology: Is actual usage 
the missing link?’, Management Science, vol. 49, no. 3, pp. 273-289. https://doi.org/10.1287/ 
mnsc.49.3.273.12736 


Dunne, JP & Masiyandima, N 2017, ‘Bilateral FDI from South Africa and income convergence in 
SADC’, African Development Review, vol. 29, no. 3, pp. 403-415. https://doi.org/10.1111/1467- 
8268.12277 


Exler, R 2003, ‘IT governance frameworks’, Analysts Corner, CIO Magazine, 10 July, 
viewed 29 March 2022, <https://www.csoonline.com/article/511235/data-protection-it- 
governance-frameworks.html> 


Fairchild, AM 2004, ‘Information technology outsourcing (ITO) governance: An examination of 
the outsourcing management maturity model’, 37th Annual Hawaii International Conference 
on System Sciences, 2004, Big Island, HI, United States of America, January, n.p. 


Flick, U 2018, An introduction to qualitative research, SAGE Publications, London. 
Flick, U 2022, An introduction to qualitative research, SAGE Publications, London. 


Fox, N, Ward, K & O’Rourke, A 2006, ‘A sociology of technology governance for the information 
age: The case of pharmaceuticals, consumer advertising and the Internet’, Sociology, 
vol. 40, no. 2, pp. 315-334. https://doi.org/10.1177/0038038506062035 


Frels, RK & Onwuegbuzie, AJ 2013, ‘Administering quantitative instruments with qualitative 
interviews: A mixed research approach’, Journal of Counseling & Development, vol. 91, 
no. 2, pp. 184-194. https://doi.org/10.1002/j.1556-6676.2013.00085.x 


Gartner 2022, Gartner forecasts worldwide IT spending to grow 3% in 2022, viewed 
22 January 2022, <https://www.gartner.com/en/newsroom/press-releases/2022-06-14- 
gartner-forecasts-worldwide-it-spending-to-grow-3-percent-in-2022> 


171 


References 


Gibbs, GR 2018, Analyzing qualitative data, vol. 6, SAGE Publications, London. 


Goldkuhl, G 2012, ‘Pragmatism vs interpretivism in qualitative information systems research’, 
European Journal of Information Systems, vol. 21, no. 2, pp. 135-146. https://doi.org/10.1057/ 
ejis.2011.54 


Gomes, JR 2007, ‘The state of IT governance in South Africa’, PhD thesis, University of Pretoria, 
Pretoria. 


Goosen, R & Rudman, R 2013, ‘An integrated framework to implement IT governance principles 
at a strategic and operational level for medium-to large-sized South African businesses’, 
International Business & Economics Research Journal, vol. 12, no. 7, pp. 835-854. https:// 
doi.org/10.19030/iber.v12i7.7972 


Grix, J 2018, The foundations of research, Bloomsbury Publishing, London. 


Guldentops, E 2014, ‘Governance of IT in small and medium-sized enterprises’, in J Devos, H van 
Landeghem & D Deschoolmeester (eds.), /nformation systems for small and medium-sized 
enterprises, Springer, Berlin, pp. 3-24. 

Guldentops, E, Van Grembergen, W & De Haes, S 2002, ‘Control and governance maturity 
survey: Establishing a reference benchmark and a self-assessment tool’, /nformation 
Systems Control Journal, vol. 6, pp. 32-35. 


Haag, S & Eckhardt, A 2014, ‘Organizational cloud service adoption: A scientometric and 
content-based literature analysis’, Journal of Business Economics, vol. 84, pp. 407-440. 
https://doi.org/10.1007/s11573-014-0716-6 


Hartley, J 2004, ‘Case study research’, in C Cassell & G Symon (eds.), Essential guide to 
qualitative methods in organizational research, SAGE Publications, London, pp. 323-333. 


Hassan, MK 2005, ‘FDI, information technology and economic growth in the MENA region’, 
viewed 21 February 2019, <http://www.mafhoum.com/press6/171T42.pdf> 


Haux, R 2006, ‘Health information systems-past, present, future’, /nternational Journal 
of Medical Informatics, vol. 75, nos. 3-4, pp. 268-281. https://doi.org/10.1016/j. 
ijmedinf.2005.08.002 


Heeks, R 2006, ‘Health information systems: Failure, success and improvisation’, /nternational 
Journal of Medical Informatics, vol. 75, no. 2, pp. 125-137. https://doi.org/10.1016/j. 
ijmedinf.2005.07.024 


Hoving, R 2007, ‘Information technology leadership challenges - Past, present, and 
future’, Information Systems Management, vol. 24, no. 2, pp. 147-153. https://doi. 
org/10.1080/10580530701221049 

Information Systems Audit and Control Association (ISACA) 2012, COBIT 5: A business 
framework for the governance and management of enterprise IT, |SACA, Rolling Meadows. 

Information Systems Audit and Control Association (ISACA) 2014, Certified in the governance 
of enterprise IT (CGEIT), ISACA, Rolling Meadows, viewed 10 November 2014, <http://www. 
isaca.org> 

Information Systems Audit and Control Association (ISACA) 2016, Holistic IT governance, risk 
management, security and privacy: Needed for effective implementation and continuous 
improvement, viewed 21 November 2017, <http://www.isaca.org> 

Ismail, S, Alias, RA & Rahman, AA 2008, ‘IT governance implementation in the Malaysian 
Ministry of Education’, 4th Postgraduate Annual Research Seminar (PARS’O8), Universiti 
Teknologi Malaysia, Skudai, 30 June-O3 July. 

Information Technology Governance Institute (ITGI) 2001, /nformation security governance: 
Guidance for boards of directors and executive management, ITGI, Rolling Meadows. 

Information Technology Governance Institute (ITGI) 2003, Board briefing on IT governance, 
2nd edn., viewed 27 January 2018, <www.itgi.org> 

Information Technology Governance Institute (ITGI) 2005, Board briefing on IT governance, 


viewed 15 December 2018, <https://www.itgovernance.co.uk/files/download/Board_ 
Briefing_on_IT_Governancev6.pdf> 


172 


References 


Information Technology Governance Institute (ITGI) 2008a, Enterprise value: Governance 
of IT investments, the Val IT framework, Version 2.0, viewed 30 May 2015, <https://www. 
academia.edu/5815223/ENTERPRISE_VALUE_GOVERNANCE_OF_IT_INVESTMENTS_ 
ENTERPRISE_VALUE_GOVERNANCE_OF_IT_INVESTMENTS_The_Val_IT_ 
Framework_2_O> 


Information Technology Governance Institute (ITGI) 2008b, /T governance global status report 
- 2008, viewed 21 November 2016, <http://www.itgi.org/AMTemplate.cfm?Section=ITGI_ 
Research_Publications&Template=/ContentManagement/ContentDisplay. 
cfm&ContentID=39735> 


Information Technology Governance Institute (ITGI) 2011, Global status report on the 
governance of IT (CGEIT) - 2011, ITGI, Rolling Meadows. 


Jaafar, NI & Jordan, E 2009, ‘Information technology governance (ITG) practices and 
accountability of information technology (IT) projects - A case study in a Malaysian 
government-linked company (GLC)’, PAC/S 2009 Proceedings, Hyderabad, India, July, 
p. 31. 


Jacobson, DD 2009, ‘Revisiting IT governance in the light of institutional theory’, 2009 
42nd Hawaii International Conference on System Sciences, Big Island, HI, United States of 
America, January, pp. 1-9. 


Jasim, AH 2010, ‘The role of IT governance in enhancing the competitiveness of for-profit 
private schools’ business’, PhD thesis, The British University in Dubai, Dubai. 


Jiandong, Z & Hongjun, X 2010, ‘The research on staff well-being in IT industry in china’, 2010 
International Conference on Optics, Photonics and Energy Engineering (OPEE), vol. 1, IEEE, 
May, pp. 48-51. 


Jokonya, O 2014, ‘A framework to assist organisations with information technology adoption 
governance’, PhD thesis, University of South Africa, Pretoria. 


Jokonya, O, Kroeze, JH & Van Der Poll, JA 2014, ‘A framework to assist organizations with 
IT adoption governance’, 2074 IEEE 6th International Conference on Cloud Computing 
Technology and Science, IEEE, December, pp. 1007-1014. 


Joshi, A, Bollen, L & Hassink, H 2013, ‘An empirical assessment of IT governance transparency: 
Evidence from commercial banking’, /nformation Systems Management, vol. 30, no. 2, 
pp. 116-136. https://doi.org/10.1080/10580530.2013.773805 


Kan, AHGR 2004, ‘IT governance and corporate governance at ING’, /nformation Systems 
Control Journal, vol. 2, pp. 26-32. 


Kan, AR 2003, ‘Managing a multi-billion dollar IT budget’, /nternational Conference on Software 
Maintenance, 2003, ICSM 2003, Proceedings, IEEE Computer Society, September, p. 2. 


King, WR & Teo, TS 1996, ‘Key dimensions of facilitators and inhibitors for the strategic use 
of information technology’, Journal of Management Information Systems, vol. 12, no. 4, 
pp. 35-53. https://doi.org/10.1080/07421222.1996.11518100 


Kurkinen, E 2013, ‘The effect of age on technology acceptance among field police officers’, 
in T Comes, F Fiedrich, S Fortier, J Geldermann & T Müller (eds.), Proceedings of the 10th 
International Conference on Information Systems for Crisis Response and Management, 
Baden-Baden, May, pp. 468-477. 

Larsen, MG 2008, ‘Technology in health care: Leveraging new innovations’, Health care 

Executive, vol. 23, no. 5, pp. 8-14. 

Latif, AA, Din, MM & Ismail, R 2010, ‘Challenges in adopting and integrating ITIL and CMMi 

in ICT division of a public utility company’, 2070 Second International Conference on 

Computer Engineering and Applications, vol. 1, Bali Island, Indonesia, March, pp. 81-86. 

Lazic, M, Heinzl, A & Neff, A 2011, ‘IT Governance Impact Model: How mature IT governance 

affects business performance’, viewed 23 November 2023, <https://aisel.aisnet.org/ 

sprouts_all/461> 


Lee, CH, Lee, JH, Park, JS & Jeong, KY 2008, ‘A study of the causal relationship between IT 
governance inhibitors and its success in Korea enterprises’, Proceedings of the 41st Annual 


173 


References 


Hawaii International Conference on System Sciences (HICSS 2008), Hawaii, United States 
of America, January, p. 433. 


Lee, D & Setiawan, B 2013, ‘Information technology governance: The effectiveness in 
banking sector’, The Proceedings of the 7th International Conference of Information and 
Communication Technology and Systems, s.l., n.d., pp. 117-122. 


Lee, J & Lee, C 2008, ‘IT governance-based IT strategy and management’, in A Cater-Steel 
(ed.), Information technology governance and service management: Frameworks and 
adaptations: Frameworks and adaptations, IGI Global, Pennsylvania, pp. 44-62. https://doi. 
org/10.4018/978-1-60566-008-0 


Leedy, PD & Ormrod, JE 2005, Practical research, vol. 108, Pearson Custom, Saddle River. 


Letsoalo, K, Brown, | & Njenga, KN 2006, ‘An investigation of enablers and inhibitors of IT 
governance implementation: A case study of a South African enterprise’, Proceedings of 
the ITG International Conference, s.l., n.d., pp. 27-35. 


Lingyu, H, Bingwu, L, Ruiping, Y & Jianzhang, W 2010, ‘An IT governance framework of 
ERP system implementation’, 2070 International Conference on Computing, Control and 
/ndustrial Engineering, vol. 2, Wuhan, China, June, pp. 431-434. 


Luftman, J & Kempaiah, RM 2007, ‘The IS organization of the future: The IT talent 
challenge’, /nformation Systems Management, vol. 24, no. 2, pp. 129-138. https://doi. 
org/10.1080/10580530701221023 


Luftman, J, Papp, R & Brier, T 1999, ‘Enablers and inhibitors of business-IT alignment’, 
Communications of the Association for information Systems, vol. 1, no. 1, p. 11. https://doi. 
org/10.17705/1cais.0O111 


Lunardi, GL, Becker, JL & Maçada, ACG 2009, ‘The financial impact of IT governance mechanisms’ 
adoption: An empirical analysis with Brazilian firms’, 2009 42nd Hawaii International 
Conference on System Sciences, Big Island, HI, United States of America, January, pp. 1-10. 


Lund, T 2012, ‘Combining qualitative and quantitative approaches: Some arguments for 
mixed methods research’, Scandinavian Journal of Educational Research, vol. 56, no. 2, 
pp. 155-165. https://doi.org/10.1080/00313831.2011.568674 


Maizlish, B & Handler, R 2005, /T (information technology) portfolio management step-by- 
step. Unlocking the business value of technology, John Wiley & Sons, Hoboken. 


Mangundu, J 2017, ‘IT governance practices and inhibitors in South African private and public 
health care’, unpublished PhD thesis, University of KwaZulu-Natal, Durban. 


Marshall, C & Rossman, GB 2014, Designing qualitative research, SAGE Publications, Los 
Angeles. 


McAfee, A 2004, ‘Do you have too much IT?’, MIT Sloan Management Review, vol. 45, no. 3, p. 18. 


McGuirk, PM & O’Neill, P 2016, ‘Using questionnaires in qualitative human geography’, in | Hay 
(ed.), Qualitative Research Methods in Human Geography, Oxford University Press, Don 
Mills, pp. 246-273. 


McKay, J, Marshall, P & Smith, L 2003, ‘Steps towards effective IT governance: Strategic IS 
planning, evaluation and benefits management’, 7th Pacific Asia Conference on Information 
Systems, Adelaide, Australia, 10-13 July. 


McManus, J & Wood-Harper, T 2007, ‘Understanding the sources of information systems 
project failure’, Journal of the Management Services Institute, vol. 51, no. 2, n.p. 


Mertens, DM 2010, ‘Philosophy in mixed methods teaching: The transformative paradigm as 
illustration’, International Journal of Multiple Research Approaches, vol. 4, no. 1, pp. 9-18. 
https://doi.org/10.5172/mra.2010.4.1.009 


Mertens, DM & Hesse-Biber, S 2012, ‘Triangulation and mixed methods research: Provocative 
positions’, Journal of Mixed Methods Research, vol. 6, no. 2, pp. 75-79. https://doi. 
org/10.1177/1558689812437100 


Miles, MB, Huberman, AM & Saldaña, J 2018, Qualitative data analysis: A methods sourcebook, 
SAGE Publications, Thousand Oaks. 


174 


References 


Mingers, J 2001, ‘Combining IS research methods: Towards a pluralist methodology’, /nformation 
Systems Research, vol. 12, no. 3, pp. 240-259. https://doi.org/10.1287/isre.12.3.240.9709 


Motloutsi, VM 2010, ‘The state of IT governance in the top 20 IT spending companies in South 
Africa’, PhD thesis, University of Pretoria, Pretoria. 


Myers, MD 2009, Qualitative research in business & management, SAGE Publications, Los 
Angeles. 


Myers, MD 2019, Qualitative research in business and management, SAGE Publications, 
Thousand Oaks, pp. 1-364. 


Nfuka, EN & Rusu, L 2010, ‘Critical success factors for effective IT governance in the public 
sector organisations in a developing country: The case for Tanzania’, 78th European 
Conference on Information Systems, ECIS 2010, Pretoria, South Africa, 07-09 June. 


Oates, BJ 2005, Researching information systems and computing, SAGE Publications, London. 


Oates, BJ, Griffiths, M & McLean, R 2022, Researching information systems and computing, 
SAGE Publications, London. 


Okoli, C & Schabram, K 2010, ‘A guide to conducting a systematic literature review of 
information systems research’, SSRN Electronic Journal, vol. 10, pp. 1-49. https://doi. 
org/10.2139/ssrn.1954824 


Oliveira, T & Martins, MF 2011, ‘Literature review of information technology adoption models 
at firm level’, Electronic Journal of Information Systems Evaluation, vol. 14, no. 1, pp. 110-121. 


Ormston, R, Spencer, L, Barnard, M & Snape, D 2014, ‘The foundations of qualitative research’, 
in Qualitative research practice: A guide for social science students and researchers, vol. 2, 
no. 7, pp. 52-55. 


Othman, M, Chan, T, Foo, E & Timbrell, G 2011, ‘Barriers to information technology governance 
adoption: A preliminary empirical investigation’, in Knowledge management and innovation 
- A business competitive edge perspective: Proceedings of the 15th International Business 
Information Management Association Conference, International Business Information 
Management Association, s.l., n.d., pp. 1771-1787. 


Othman, MFI & Chan, T 2013, ‘Barriers to formal IT governance practice - Insights from a 
qualitative study’, 2073 46th Hawaii International Conference on System Sciences, IEEE, 
January, pp. 4415-4424, 


Patel, NV 2004, ‘An emerging strategy for e-business IT governance’, in W van Grembergen 
(ed.), Strategies for information technology governance, Idea Group Publishing, Hershey, 
pp. 81-98. 


Peng, GC, Nunes, JMB & Annansingh, F 2011, ‘Investigating information systems with mixed- 
methods research’, Proceedings of the IADIS International Workshop on Information 
Systems Research Trends, Approaches and Methodologies, Rome, Italy, 20 July. 


Pereira, R, Almeida, R & Da Silva, MM 2014, ‘IT governance patterns in the Portuguese financial 
industry’, 2014 47th Hawaii International Conference on System Sciences, Big Island, HI, 
United States of America, January, pp. 4386-4395. 


Pereira, R & Mira da Silva, M 2012, ‘A literature review: Guidelines and contingency factors 
for IT governance’, European, Mediterranean & Middle Eastern Conference on Information 
Systems, Munique, Alemanha, June, pp. 342-360. 

Peterson, RR 2003, ‘Information strategies and tactics for information technology governance’, 
in W van Grembergen (ed.), Strategies for information technology governance, Idea Group 
Publishing, Hershey, pp. 37-80. 

PricewaterhouseCoopers (PWC) 2012, Top health industry issues of 2012, viewed O04 July 2016, 
<https://www.pwc.com/gx/en/healthcare/pdf/global-top-health-industry-issues-2018-pwc 
.pdf> 

PricewaterhouseCoopers (PWC) 2014, Board oversight of risk: Defining risk appetite in plain 
English, viewed 23 November 2023, <https://docplayer.net/12012930-Board-oversight-of- 
risk-defining-risk-appetite-in-plain-english.Atml> 


175 


References 


Reeves, TC 2000, ‘Socially responsible educational technology research’, Educational 
Technology, vol. 40, no. 6, pp. 19-28. 


Rehman, AA & Alharthi, K 2016, ‘An introduction to research paradigms’, International Journal 
of Educational Investigations, vol. 3, no. 8, pp. 51-59. 


Renner, A, Muller, J & Theissler, A 2022, ‘State-of-the-art on writing a literature review: An 
overview of types and components’, 2022 IEEE Global Engineering Education Conference 
(EDUCON), Tunis, Tunisia, March, pp. 1895-1902. 


Ribbers, PM, Peterson, RR & Parker, MM 2002, ‘Designing information technology governance 
processes: Diagnosing contemporary practices and competing theories’, Proceedings of 
the 35th Annual Hawaii International Conference on System Sciences, Big Island, HI, United 
States of America, January, pp. 3143-3154. 


Riemer, K & Johnston, RB 2019, ‘Wither interpretivism? Re-interpreting interpretation to fit 
a world of ubiquitous ICT’, Proceedings of ICIS 2019, Munich, Germany, 15-18 December. 


Robson, C 2002, Real world research: A resource for social scientists and practitioner- 
researchers, Wiley-Blackwell, Oxford. 


Rogers, EM 1995a, ‘Diffusion of innovations: Modifications of a model for telecommunications’, 
in Die diffusion von innovationen in der telekommunikation, Allen Institute for Al, Seattle, 
pp. 25-38. 


Rogers, EM 1995b, Diffusion of innovations, The Free Press, New York. 
Rogers, EM 2003, Diffusion of innovations, 5th edn, The Free Press, New York. 


Rothenberg, BM & Korn, A 2005, ‘The opportunities and challenges posed by the rapid 
growth of diagnostic imaging’, Journal of the American College of Radiology, vol. 2, no. 5, 
pp. 407-410. https://doi.org/10.1016/j.jacr.2005.02.012 


Rubin, HJ & Rubin, IS 2011, Qualitative interviewing: The art of hearing data, SAGE Publications. 
Thousand Oaks. 


Sarantakos, S 2017, Social research, Bloomsbury Publishing, London. 


Schwarz, A & Hirschheim, R 2003, ‘An extended platform logic perspective of IT governance: 
Managing perceptions and activities of IT’, The Journal of Strategic Information Systems, 
vol. 12, no. 2, pp. 129-166. https://doi.org/10.1016/s0963-8687(03)00021-0 


Scotland, J 2012, ‘Exploring the philosophical underpinnings of research: Relating ontology 
and epistemology to the methodology and methods of the scientific, interpretive, and 
critical research paradigms’, English Language Teaching, vol. 5, no. 9, pp. 9-16. https://doi. 
org/10.5539/elt.vS5n9p9 

Simonsson, M 2008, ‘Predicting it governance performance: A method for model-based 
decision-making’, PhD thesis, KTH, Stockholm. 

Simonsson, M & Ekstedt, M 2006, ‘Getting the priorities right: Literature vs practice on 
IT governance’, 2006 Technology Management for the Global Future-PICMET 2006 
Conference, Istanbul, vol. 1, IEEE, July, pp. 18-26. 

Simonsson, M, Johnson, P & Ekstedt, M 2010, ‘The effect of IT governance maturity on IT 
governance performance’, /nformation Systems Management, vol. 27, no. 1, pp. 10-24. 
https://doi.org/10.1080/10580530903455106 

Sohal, AS & Fitzpatrick, P 2002, ‘IT governance and management in large Australian 
organisations’, /nternational Journal of Production Economics, vol. 75, no. 1-2, pp. 97-112. 
https://doi.org/10.1016/S0925-5273(01)00184-0 

Spremić, M 2009, ‘IT governance mechanisms in managing IT business value’, WSEAS 
Transactions on Information Science and Applications, vol. 6, no. 6, pp. 906-915. 

Stake, RE 2000, ‘Case studies’, in NK Denzin & YS Lincoln (eds.), Handbook of qualitative 
research, Sage Publications, Thousand Oaks, pp. 435-453. 

Standish Group 2004, Third quarter research report. Chaos demographics, viewed 
05 March 2015, <http://blog.nalis.fr/public/pdf/q3-spotlight.pdf>. 


176 


References 


Sturman, MC 1999, ‘Multiple approaches to analyzing count data in studies of individual 
differences: The propensity for type | errors, illustrated with the case of absenteeism 
prediction’, Educational and Psychological Measurement, vol. 59, no. 3, pp. 414-430. 


Suomi, R & Tähkäpää, J 2004, ‘Governance structures for IT in the health care industry’, in 
W van Grembergen (ed.), Strategies for information technology governance, Idea Group 
Publishing, Hershey, pp. 357-381. 


Symons, C 2005, /T governance framework, Forrester Research, Cambridge. 


Tashakkori, A & Teddlie, C 2009, ‘Integrating qualitative and quantitative approaches 
to research’, in L Mickman & DJ Rog (eds.), The SAGE handbook of applied social 
research methodism, vol. 2, SAGE Publications, Los Angeles, pp. 283-317. https://doi. 
org/10.4135/9781483348858.n9 


Teddlie, C & Tashakkori, A 2010, ‘Overview of contemporary issues in mixed methods 
research’, in SAGE handbook of mixed methods in social and behavioral research, vol. 2, 
SAGE Publications, Los Angeles, pp. 1-44. 


Teo, HH, Wei, KK & Benbasat, | 2003, ‘Predicting intention to adopt interorganizational 
linkages: An institutional perspective’, M/S Quarterly, vol. 27. no. 1, pp. 19-49. https://doi. 
org/10.2307/30036518 


Teo, TS & Ang, JS 1999, ‘Critical success factors in the alignment of IS plans with business 
plans’, International Journal of Information Management, vol. 19, no. 2, pp. 173-185. 


Thanh, NC & Thanh, TT 2015, ‘The interconnection between interpretivist paradigm and 
qualitative methods in education’, American Journal of Educational Science, vol. 1, no. 2, 
pp. 24-27. 


Tonelli, AO, De Souza Bermejo, PH, Aparecida dos Santos, P, Zuppo, L & Zambalde, AL 2017, 
‘IT governance in the public sector: A conceptual model’, /nformation Systems Frontiers, 
vol. 19, no. 3, pp. 593-610. https://doi.org/10.1007/s10796-015-9614-x 


Tornatzky, LG, Fleischer, M & Chakrabarti, AK 1990, Processes of technological innovation, 
Lexington Books, Pennsylvania. 


Trudel, MC, Paré, G & Laflamme, J 2012, ‘Health information technology success and the art 
of being mindful: Preliminary insights from a comparative case study analysis’, Hea/th Care 
Management Review, vol. 37, no. 1, pp. 31-42. https://doi.org/10.1097/hmr.0b013e31822aa430 


Tsiknakis, M & Kouroubali, A 2009, ‘Organizational factors affecting successful adoption of 
innovative eHealth services: A case study employing the FITT framework’, International Journal 
of Medical Informatics, vol. 78, no. 1, pp. 39-52. https://doi.org/10.1016/j.ijmedinf.2008.07.001 


United Nations (UN) 2021, Technology and innovations report, viewed O7 March 2023, <https:// 
unctad.org/system/files/official-document/tir2020_en.pdf> 


Van Grembergen, W (ed.) 2004, Strategies for information technology governance, Idea 
Group Publishing, Hershey. 


Van Grembergen, W & De Haes, S 2009, Enterprise governance of information technology: 
Achieving strategic alignment and value, Springer, Cham. 


Van Grembergen, W & De Haes, S 2018, ‘Introduction to the Minitrack on IT governance and its 
mechanisms’, Proceedings of the 51st Hawaii International Conference on System Sciences, 
s.l., n.d., pp. 4877-4879. 


Van Grembergen, W, De Haes, S & Guldentops, E 2004, ‘Structures, processes and relational 
mechanisms for IT governance’, in W van Grembergen (ed.), Strategies for information 
technology governance, Idea Group Publishing, Hershey, pp. 1-36. 


Vannoy, SA & Salam, AF 2010, ‘Managerial interpretations of the role of information systems in 
competitive actions and firm performance: A grounded theory investigation’, /nformation 
Systems Research, vol. 21, no. 3, pp. 496-515. https://doi.org/10.1287/isre.1100.0301 


Venkatesh, V, Brown, SA & Bala, H 2013, ‘Bridging the qualitative-quantitative divide: Guidelines 
for conducting mixed methods research in information systems’, MIS Quarterly, vol. 37, 
no. 1, pp. 21-54. https://doi.org/10.25300/misq/2013/37.1.02 


177 


References 


Verschuren, P 2003, ‘Case study as a research strategy: Some ambiguities and opportunities’, 
International Journal of Social Research Methodology, vol. 6, no. 2, pp. 121-139. https://doi. 
org/10.1080/13645570110106154 


Walsham, G 1995, ‘Interpretive case studies in IS research: Nature and method’, European 
Journal of Information Systems, vol. 4, no. 2, pp. 74-81. https://doi.org/10.1057/ejis.1995.9 


Weill, P & Broadbent, M 1998, Leveraging the new infrastructure: How market leaders capitalize 
on information technology, Harvard Business Press, Boston, Massachusetts. 


Weill, P & Ross, JW 2004a, /T governance: How top performers manage IT decision rights for 
superior resu/ts, Harvard Business Press, Boston, Massachusetts. 


Weill, P & Ross, JW 2004b, /T governance on one page, Harvard Business Publishing, Boston. 


Weill, P & Woodham, R 2002, Don’t just lead, govern: Implementing effective IT governance, 
MIT Sloan School of Management, Cambridge. 


Well, DN 2007, ‘Accounting for the effect of health on economic growth’, The Quarterly 
Journal of Economics, vol. 122, no. 3, pp. 1265-1306. https://doi.org/10.1162/qjec.122.3.1265 


Wibowo, AM & Yuwono. B 2008, Driving factors, enablers & inhibitors of IT value delivery & risk 
management in IT governance, University of Indonesia, Depok. 


Wilkin, CL & Riddett, J 2009, ‘IT governance challenges in a large not-for-profit health care 
organization: The role of intranets’, E/ectronic Commerce Research, vol. 9, pp. 351-374. 
https://doi.org/10.1007/s10660-009-9038-0 


Winniford, M, Conger, S & Erickson-Harris, L 2009, ‘Confusion in the ranks: IT service 
management practice and terminology’, /nformation Systems Management, vol. 26, no. 2, 
pp. 153-163. https://doi.org/10.1080/10580530902797532 


Winter, G 2000, ‘A comparative discussion of the notion of validity in qualitative and quantitative 
research’, The Qualitative Report, vol. 4, no. 3, pp. 1-14. https://doi.org/10.46743/2160- 
3715/2000.2078 


Wooten, KC, Rose, RM, Ostir, GV, Calhoun, WJ, Ameredes, BT & Brasier, AR 2014, ‘Assessing and 
evaluating multidisciplinary translational teams: A mixed methods approach’, Eva/uation & 
The Health Professions, vol. 37, no. 1, pp. 33-49. https://doi.org/10.1177/0163278713504433 


Wu, SPJ, Straub, DW & Liang, TP 2015, ‘How information technology governance mechanisms 
and strategic alignment influence organizational performance’, M/S Quarterly, vol. 39, 
no. 2, pp. 497-518. https://doi.org/10.25300/misgq/2015/39.2.10 


Xue, Y, Liang, H & Boulton, WR 2008, ‘Information technology governance in information 
technology investment decision processes: The impact of investment characteristics, 
external environment, and internal context’, M/S Quarterly, vol. 32, no. 1, pp. 67-96. https:// 
doi.org/10.2307/25148829 


Yin, RK 2009, Case study research: Design and methods, vol. 5, SAGE Publications, Thousand 
Oaks. 

Yin, RK 2011, Applications of case study research, SAGE Publications, Thousand Oaks. 

Yin, RK 2003, ‘Design and methods’, in Case study research, vol. 3, no. 9.2, n.p. 

Young, J, Ridley, G & Carroll, P 2014, ‘COBIT and its utilization: A framework from the literature’, 
Hawaii International Conference on System Sciences, s.l., n.d. 


Zhang, P, Zhao, K & Kumar, RL 2016, ‘Impact of IT governance and IT capability on firm 
performance’, /nformation Systems Management, vol. 33, no. 4, pp. 357-373. https://doi.org/ 
10.1080/10580530.2016.1220218 


Zhang, S & Le Fever, HT 2013, ‘An examination of the practicability of COBIT framework and 
the proposal of a COBIT-BSC model’, Journal of Economics, Business and Management, 
vol. 1, no. 4, pp. 391-395. https://doi.org/10.7763/joebm.2013.v1.84 


Zmud, RW 1982, ‘Diffusion of modern software practices: Influence of centralization and 
formalization’, Management Science, vol. 28, no. 12, pp. 1421-1431. https://doi.org/10.1287/ 
mnsc.28.12.1421 


178 


[[AQ: 
Please QC 
according 
to the latest 
edits and 
update as/if 
needed]] 


Index 


B 
background, 1-2, 4, 6, 8, 10, 18, 33-34, 
57-59, 63, 75 


case study, 28, 31-32, 52-53, 56-61, 63, 73, 
79, 145, 158 

constructs, 36-37, 41, 81, 118, 148, 153, 162 

critical paradigm, 49, 52 


E 
epistemology, 47-48, 52 


l 

implementation, 1, 3-7, 9-11, 13-14, 18-19, 
21, 23-24, 26-32, 34-43, 55-57, 74, 
82, 89-90, 94-95, 100-101, 103-107, 
109-115, 122-126, 128, 133-137, 142-143, 
145-147, 149, 153-154, 157-167 

inhibitors, 1, 6-7, 9-11, 13-15, 29-32, 37, 
42-43, 45, 55-56, 73-74, 81, 89, 106, 
109-114, 117, 133-134, 136-137, 145, 
147-151, 153, 157-158, 160, 164-167 

introduction, 1, 9, 13, 21, 45, 55, 89, 98, 117, 
145, 157 

IT governance drivers, 14, 21-22, 41, 73, 81, 
100, 120-123, 149-150, 153, 158 


J 
justification, 1, 7, 9, 15, 43, 51, 53, 64, 96 


M 

methodology, 9, 14, 46-49, 52-53, 55-57, 
60-61, 72, 90, 125, 145, 154, 158 

mixed methods, 46-48, 51-52, 64-67, 
79-80, 82, 90, 143, 145-146, 154, 157 


(0) 
ontology, 47-48 


P 

pain points, 21-22, 159 

performance, 2-4, 6-7, 9, 13-16, 18-19, 
21-22, 30-31, 33, 40, 43, 50, 63, 70, 
74, 81-82, 94, 113-115, 120-121, 129, 
138-142, 147, 160-161 

philosophical foundation, 55, 90 

philosophical worldviews, 46 

positivist, 47, 49-52, 59 

practices, 1, 3-4, 6, 13, 19, 21-22, 28, 33-34, 38, 
45, 55-56, 59-60, 66-67, 89, 91, 113, 117, 
119, 145, 151-152, 157, 161 

pragmatism, 46, 51-52, 105, 162, 165 

problem statement, 1, 9, 13, 28, 58, 157 


R 

research approach, 46, 48, 53, 56-58, 
60-61, 88 

T 


trigger events, 21-22, 97, 159 


179 


This scholarly book focuses on the governance of information 
technology (IT) investments in both the private and public health 
care sectors, addressing the intricate challenges associated with 
aligning IT initiatives, delivering value and ultimately realising 
returns on IT investments. The book sheds light on the pressing 
necessity for rigorous scientific inquiry into the role of IT governance 
in enhancing health care service delivery in South Africa. The 
presented current research holds relevance across the dimensions 
of technological innovation, health care provisioning and 
management. This book comprehensively examines the hurdles 
faced during the implementation of IT governance. By examining 
IT governance practices from the perspective of both IT and 
business decision-makers within the private and public health care 
domains, the book offers a significant contribution to discussions 
on technological innovation in service delivery, including perspectives 
from the public and private sectors. Throughout its analysis, the 
book considers contextual factors such as the environment, 
organisational dynamics and IT governance, all of which can 
potentially impede effective governance processes. The book 
emphasises the substantial influence of organisational factors as 
impediments to successful IT governance. It demonstrates how 
health care organisations’ perceptions and approaches to 
IT governance significantly shape the trajectory of their endeavours. 
This interdisciplinary research offers fresh insights into the 
implementation of IT governance, particularly within the context 
of developing economies characterised by resource limitations. 
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